TYPO3 Fixes Cross-Site Scripting Vulnerability in Multiple Versions

CVE-2024-34357

5.4MEDIUM

Key Information

Vendor: Typo3
Status: Typo3
Vendor: CVE Published:; 14 May 2024

Summary

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

Affected Version(s)

typo3 < 9.0.0, 9.5.48

typo3 < 10.0.0, 10.4.45

typo3 < 11.0.0, 11.5.37

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published.
May 14, 2024
Vulnerability Reserved.
May 2, 2024

Collectors

NVD DatabaseMitre Database