Vulnerability advisory
CVE-2024-34357
TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
Also known as GHSA-hw6c-6gwq-3m3m
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 8c01ea0cd9f5ecd3003d46c5fae521784d619a73 | 8c01ea0cd9f5ecd3003d46c5fae521784d619a73 |
| 36096733dea4bd6f6168209609fa879dc25c0138 to before 85cb1b09b03366d4cf690064d9f2afb013b27c82 | 85cb1b09b03366d4cf690064d9f2afb013b27c82 |
| fd8745e46bb11773e85524b8ee9650dabe340713 to before dbe306ed9ddeda3c56f78ba919a8f8b4642dd6a4 | dbe306ed9ddeda3c56f78ba919a8f8b4642dd6a4 |
| Not specified | 376474904f6b9a54dc1b785a2e45277cbd13b0d7 |
| Not specified | b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee |
| Not specified | d774642381354d3bf5095a5a26e18acd2767f0b1 |
Also listed as affected (63)
| |
Description
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the ShowImageController (_eID tx_cms_showpic_) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
References
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34357.json ↗
- Advisorygithub.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-34357 ↗
- Advisorytypo3.org/security/advisory/typo3-core-sa-2024-009 ↗
- Fixgithub.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7 ↗
- Fixgithub.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee ↗
- Fixgithub.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1 ↗