Vulnerability advisory

CVE-2024-22188

Published Mar 5, 2024Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/benjaminkott/bootstrap_package ↗
87216a645395adbc8c2cfc7ddcf97f4ecf6a90bf through 87216a645395adbc8c2cfc7ddcf97f4ecf6a90bf	No fix listed
GIT github.com/typo3/typo3 ↗
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 7cd2396f0be8e4ce1a2554f0def6ebc4420ab436	`7cd2396f0be8e4ce1a2554f0def6ebc4420ab436`
36096733dea4bd6f6168209609fa879dc25c0138 to before 3f83ff31e72053761f33b975410fa2881174e0e5	`3f83ff31e72053761f33b975410fa2881174e0e5`
fd8745e46bb11773e85524b8ee9650dabe340713 through fd8745e46bb11773e85524b8ee9650dabe340713	No fix listed
Also listed as affected (57) `13.0.0` `v13.0.0` `v12.4.10` `v11.5.34` `v12.4.9` `v12.4.8` `v11.5.33` `v11.5.32` `v12.4.7` `v12.4.6` `v11.5.31` `v12.4.5` `v12.4.4` `v11.5.30` `v11.5.29` `v12.4.3` `v11.5.28` `v12.4.2` `v12.4.1` `v11.5.27` `v12.4.0` `v11.5.26` `v12.3.0` `v11.5.25` `v11.5.24` `v12.2.0` `v11.5.23` `v11.5.22` `v11.5.21` `v11.5.20` `v12.1.0` `v11.5.19` `v11.5.18` `v11.5.17` `v12.0.0` `v11.5.16` `v11.5.15` `v11.5.14` `v11.5.13` `v11.5.12` `v11.5.11` `v11.5.10` `v11.5.9` `v11.5.8` `v11.5.7` `v11.5.6` `v11.5.5` `v11.5.4` `v11.5.3` `v11.5.2` `v11.5.1` `v11.5.0` `v11.4.0` `v11.3.0` `v11.2.0` `v11.1.0` `v11.0.0`

Description

TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.

CVE-2024-22188

Affected versions

Repository

Description

References