TYPO3 Fixes Cross-Site Scripting Vulnerability in Multiple Versions
CVE-2024-34357

5.4MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3
Vendor
CVE Published:
14 May 2024

What is CVE-2024-34357?

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the ShowImageController (_eID tx_cms_showpic_) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

Affected Version(s)

typo3 >= 9.0.0, < 9.5.48 < 9.0.0, 9.5.48

typo3 >= 10.0.0, < 10.4.45 < 10.0.0, 10.4.45

typo3 >= 11.0.0, < 11.5.37 < 11.0.0, 11.5.37

References

https://github.com/TYPO3/typo3/security/advisories/GHSA-h...
x_refsource_CONFIRM
https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1...
x_refsource_MISC
https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.