CVSS: 3.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-47780 – Information Disclosure in TYPO3 Page Tree
https://notcve.org/view.php?id=CVE-2024-47780
TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability. • https://github.com/TYPO3/typo3/security/advisories/GHSA-rf5m-h8q9-9w6q https://typo3.org/security/advisory/typo3-core-sa-2024-012 • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-34358 – TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController
https://notcve.org/view.php?id=CVE-2024-34358
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&... • https://github.com/TYPO3/typo3/commit/05c95fed869a1a6dcca06c7077b83b6ea866ff14 https://github.com/TYPO3/typo3/commit/1e70ebf736935413b0531004839362b4fb0755a5 https://github.com/TYPO3/typo3/commit/df7909b6a1cf0f12a42994d0cc3376b607746142 https://github.com/TYPO3/typo3/security/advisories/GHSA-36g8-62qv-5957 https://typo3.org/security/advisory/typo3-core-sa-2024-010 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-34357 – TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
https://notcve.org/view.php?id=CVE-2024-34357
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described. TYPO3 es un sistema de gestión de contenidos empresariales. • https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7 https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1 https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m https://typo3.org/security/advisory/typo3-core-sa-2024-009 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-34356 – TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
https://notcve.org/view.php?id=CVE-2024-34356
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described. TYPO3 es un sistema de gestión de contenidos empresariales. • https://github.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156 https://github.com/TYPO3/typo3/commit/d0393a879a32fb4e3569acad6bdb5cda776be1e5 https://github.com/TYPO3/typo3/commit/e95a1224719efafb9cab2d85964f240fd0356e64 https://github.com/TYPO3/typo3/security/advisories/GHSA-v6mw-h7w6-59w3 https://typo3.org/security/advisory/typo3-core-sa-2024-008 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34355 – TYPO3 vulnerable to an HTML Injection in the History Module
https://notcve.org/view.php?id=CVE-2024-34355
TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described. • https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375 https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jc https://typo3.org/security/advisory/typo3-core-sa-2024-007 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-116: Improper Encoding or Escaping of Output •