Vulnerability advisory
CVE-2024-34356
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
Also known as GHSA-v6mw-h7w6-59w3
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 8c01ea0cd9f5ecd3003d46c5fae521784d619a73 | 8c01ea0cd9f5ecd3003d46c5fae521784d619a73 |
| 36096733dea4bd6f6168209609fa879dc25c0138 to before 85cb1b09b03366d4cf690064d9f2afb013b27c82 | 85cb1b09b03366d4cf690064d9f2afb013b27c82 |
| fd8745e46bb11773e85524b8ee9650dabe340713 to before dbe306ed9ddeda3c56f78ba919a8f8b4642dd6a4 | dbe306ed9ddeda3c56f78ba919a8f8b4642dd6a4 |
| Not specified | 2832e2f51f929aeddb5de7d667538a33ceda8156 |
| Not specified | d0393a879a32fb4e3569acad6bdb5cda776be1e5 |
| Not specified | e95a1224719efafb9cab2d85964f240fd0356e64 |
Also listed as affected (63)
| |
Description
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.
References
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34356.json ↗
- Advisorygithub.com/TYPO3/typo3/security/advisories/GHSA-v6mw-h7w6-59w3 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-34356 ↗
- Advisorytypo3.org/security/advisory/typo3-core-sa-2024-008 ↗
- Fixgithub.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156 ↗
- Fixgithub.com/TYPO3/typo3/commit/d0393a879a32fb4e3569acad6bdb5cda776be1e5 ↗
- Fixgithub.com/TYPO3/typo3/commit/e95a1224719efafb9cab2d85964f240fd0356e64 ↗