Vulnerability advisory
CVE-2024-47780
Information Disclosure in TYPO3 Page Tree
Also known as GHSA-rf5m-h8q9-9w6q
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before a3abdf398dadca2083151d88bb873b252c5f94f3 | a3abdf398dadca2083151d88bb873b252c5f94f3 |
| 36096733dea4bd6f6168209609fa879dc25c0138 to before bcec228562e6af38aaeb08899c9e93bcedd50d5a | bcec228562e6af38aaeb08899c9e93bcedd50d5a |
| fd8745e46bb11773e85524b8ee9650dabe340713 to before f98c944f6e3111ffd699791dcfb0c2ace7f76195 | f98c944f6e3111ffd699791dcfb0c2ace7f76195 |
Also listed as affected (75)
| |
Description
TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability.