CVSS: 4.9EPSS: 0%CPEs: 6EXPL: 0CVE-2024-25119 – Information Disclosure of Encryption Key in TYPO3 Install Tool
https://notcve.org/view.php?id=CVE-2024-25119
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. • https://github.com/TYPO3/typo3/security/advisories/GHSA-h47m-3f78-qp9g https://typo3.org/security/advisory/typo3-core-sa-2024-004 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2024-25120 – Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
https://notcve.org/view.php?id=CVE-2024-25120
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. • https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Functions/Typolink.html#resource-references https://github.com/TYPO3/typo3/security/advisories/GHSA-wf85-8hx9-gj7c https://typo3.org/security/advisory/typo3-core-sa-2024-005 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2024-25121 – Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3
https://notcve.org/view.php?id=CVE-2024-25121
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. • https://github.com/TYPO3/typo3/security/advisories/GHSA-rj3x-wvc6-5j66 https://typo3.org/security/advisory/typo3-core-sa-2024-006 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2023-47125 – By-passing Cross-Site Scripting Protection in HTML Sanitizer
https://notcve.org/view.php?id=CVE-2023-47125
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. • https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54 https://typo3.org/security/advisory/typo3-core-sa-2023-007 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47126 – Information Disclosure in Install Tool in typo3/cms-install
https://notcve.org/view.php?id=CVE-2023-47126
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. • https://github.com/TYPO3/typo3/commit/1a735dac01ec7b337ed0d80c738caa8967dea423 https://github.com/TYPO3/typo3/security/advisories/GHSA-p2jh-95jg-2w55 https://typo3.org/security/advisory/typo3-core-sa-2023-005 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •