Cross-Site Request Forgery Vulnerability in TYPO3 Content Management Framework
CVE-2024-55893
What is CVE-2024-55893?
A CSRF vulnerability has been identified in TYPO3's backend user interface that allows attackers to exploit insecure configurations. When the 'security.backend.enforceReferrer' feature is disabled and the 'BE/cookieSameSite' setting is set to lax or none, attackers can trick users into accessing malicious URLs. This can lead to unwanted state changes in downstream components such as the Log Module, enabling malicious users to manipulate or erase log entries. Users with active sessions must be cautious, as successful exploitation relies on social engineering techniques to execute unauthorized commands.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
typo3 >= 10.0.0, < 10.4.48 < 10.0.0, 10.4.48
typo3 >= 11.0.0, < 11.5.42 < 11.0.0, 11.5.42
typo3 >= 12.0.0, < 12.4.25 < 12.0.0, 12.4.25
References
CVSS V3.1
Timeline
Vulnerability published