Vulnerability advisory

GHSA-v6mw-h7w6-59w3

TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module

Published May 14, 2024Updated Sep 10, 2026OSV record ↗

Also known as CVE-2024-34356

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`9.0.0` to before 9.5.48	`9.5.48`Advisories →
Also listed as affected (41) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.10` `v9.5.11` `v9.5.12` `v9.5.13` `v9.5.14` `v9.5.15` `v9.5.16` `v9.5.17` `v9.5.18` `v9.5.19` `v9.5.2` `v9.5.20` `v9.5.21` `v9.5.22` `v9.5.23` `v9.5.24` `v9.5.25` `v9.5.26` `v9.5.27` `v9.5.28` `v9.5.29` `v9.5.3` `v9.5.30` `v9.5.31` `v9.5.4` `v9.5.5` `v9.5.6` `v9.5.7` `v9.5.8` `v9.5.9`
`10.0.0` to before 10.4.45	`10.4.45`Advisories →
Also listed as affected (43) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.10` `v10.4.11` `v10.4.12` `v10.4.13` `v10.4.14` `v10.4.15` `v10.4.16` `v10.4.17` `v10.4.18` `v10.4.19` `v10.4.2` `v10.4.20` `v10.4.21` `v10.4.22` `v10.4.23` `v10.4.24` `v10.4.25` `v10.4.26` `v10.4.27` `v10.4.28` `v10.4.29` `v10.4.3` `v10.4.30` `v10.4.31` `v10.4.32` `v10.4.33` `v10.4.34` `v10.4.36` `v10.4.37` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`11.0.0` to before 11.5.37	`11.5.37`Advisories →
Also listed as affected (46) `v11.0.0` `v11.1.0` `v11.1.1` `v11.2.0` `v11.3.0` `v11.3.1` `v11.3.2` `v11.3.3` `v11.4.0` `v11.5.0` `v11.5.1` `v11.5.10` `v11.5.11` `v11.5.12` `v11.5.13` `v11.5.14` `v11.5.15` `v11.5.16` `v11.5.17` `v11.5.18` `v11.5.19` `v11.5.2` `v11.5.20` `v11.5.21` `v11.5.22` `v11.5.23` `v11.5.24` `v11.5.25` `v11.5.26` `v11.5.27` `v11.5.28` `v11.5.29` `v11.5.3` `v11.5.30` `v11.5.31` `v11.5.32` `v11.5.33` `v11.5.34` `v11.5.35` `v11.5.36` `v11.5.4` `v11.5.5` `v11.5.6` `v11.5.7` `v11.5.8` `v11.5.9`
`12.0.0` to before 12.4.15	`12.4.15`Advisories →
Also listed as affected (22) `v12.0.0` `v12.1.0` `v12.1.1` `v12.1.2` `v12.1.3` `v12.2.0` `v12.3.0` `v12.4.0` `v12.4.1` `v12.4.10` `v12.4.11` `v12.4.12` `v12.4.13` `v12.4.14` `v12.4.2` `v12.4.3` `v12.4.4` `v12.4.5` `v12.4.6` `v12.4.7` `v12.4.8` `v12.4.9`
`13.0.0` to before 13.1.1	`13.1.1`Advisories →
Also listed as affected (3) `v13.0.0` `v13.0.1` `v13.1.0`

Description

Problem

The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module.

Solution

Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.

Credits

Thanks to TYPO3 core & security team member Benjamin Franzke who reported and fixed the issue.

References

TYPO3-CORE-SA-2024-008