Vulnerability advisory
CVE-2024-55892
Potential Open Redirect via Parsing Differences in TYPO3
Also known as GHSA-2fx5-pggv-6jjr
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/typo3 ↗ | |
| 36096733dea4bd6f6168209609fa879dc25c0138 to before 3af8b62bc5546a2ea647c3b16fc480e1120cd215 | 3af8b62bc5546a2ea647c3b16fc480e1120cd215 |
| fd8745e46bb11773e85524b8ee9650dabe340713 to before 8b11a060db771bb5be473ef9f6cb30382b8dc917 | 8b11a060db771bb5be473ef9f6cb30382b8dc917 |
Also listed as affected (37)
| |
Description
TYPO3 is a free and open source Content Management Framework. Applications that use TYPO3\CMS\Core\Http\Uri to parse externally provided URLs (e.g., via a query parameter) and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the validation checks. Users are advised to update to TYPO3 versions 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, 13.4.3 which fix the problem described. There are no known workarounds for this vulnerability.