p PatchFirst

CVE-2024-34355

CVE-2024-34355 · TYPO3 vulnerable to an HTML Injection in the History Module

This page contains facts from public vulnerability sources. Check the original advisory before updating.

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

CVSS 3.5 · Low · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • typo3

    Versions
    • >= 13.0.0, < 13.1.1: Affected

    No fix published

  • typo3/cms-core Packagist

    Versions
    • v13.0.0
    • v13.0.1
    • v13.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0, < 13.1.1

    Update to 13.1.1

Original sources

Check your server →