Vulnerability advisory
CVE-2024-34355
TYPO3 vulnerable to an HTML Injection in the History Module
Also known as GHSA-xjwx-78x7-q6jc
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| fd8745e46bb11773e85524b8ee9650dabe340713 to before dbe306ed9ddeda3c56f78ba919a8f8b4642dd6a4 | dbe306ed9ddeda3c56f78ba919a8f8b4642dd6a4 |
| Not specified | 56afa304ba8b5ad302e15df5def71bcc8d820375 |
Also listed as affected (2)
| |
Description
TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.
References
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34355.json ↗
- Advisorygithub.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jc ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-34355 ↗
- Advisorytypo3.org/security/advisory/typo3-core-sa-2024-007 ↗
- Fixgithub.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375 ↗