p PatchFirst

PatchFirst · Latest vulnerabilities

typo3/cms vulnerabilities

Vulnerabilities published for typo3/cms in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 188

  1. GHSA-f3wf-q4fj-3gxf

    Medium · CVSS 6.5Fix available

    TYPO3 Denial of Service in Online Media Asset Handling

    Online Media Asset Handling (*`.youtube` and *`.vimeo` files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.

    typo3/cms typo3/cms typo3/cmsPHP
    • Update to 7.6.32
    • Update to 8.7.21
    • Update to 9.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. GHSA-f777-f784-36gm

    High · CVSS 8.1Fix available

    TYPO3 Security Misconfiguration in Install Tool Cookie

    It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.

    typo3/cms typo3/cms typo3/cmsPHP
    • Update to 7.6.32
    • Update to 8.7.21
    • Update to 9.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. GHSA-2rcw-9hrm-8q7q

    Medium · CVSS 5.4Fix available

    TYPO3 Cross-Site Scripting in Frontend User Login

    Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template patterns that are affected are - ###FEUSER_[fieldName]### using system extension felogin - <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)

    typo3/cms typo3/cms typo3/cmsPHP
    • Update to 7.6.32
    • Update to 8.7.21
    • Update to 9.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. GHSA-7q33-hxwj-7p8v

    Medium · CVSS 5.4Fix available

    TYPO3 Cross-Site Scripting in Backend Modal Component

    Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.

    typo3/cms typo3/cms typo3/cmsPHP
    • Update to 7.6.32
    • Update to 8.7.21
    • Update to 9.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. GHSA-8m6j-p5jv-v69w

    Medium · CVSS 5.4Fix available

    TYPO3 Cross-Site Scripting in Online Media Asset Rendering

    Failing to properly encode user input, online media asset rendering (`*.youtube` and `*.vimeo` files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.

    typo3/cms typo3/cms typo3/cmsPHP
    • Update to 7.6.32
    • Update to 8.7.21
    • Update to 9.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. GHSA-8h4m-r4wm-xj7r

    High · CVSS 8.8Fix available

    TYPO3 Arbitrary Code Execution via File List Module

    Due to missing file extensions in $GLOBALS['TYPO3_CONF_VARS']['BE'][‘fileDenyPattern’], backend users are allowed to upload *.phar, *.shtml, *.pl or *.cgi files which can be executed in certain web server setups. A valid backend user account is needed in order to exploit this vulnerability. Derivatives of Debian GNU Linux are handling *.phar files as PHP applications since PHP 7.1 (for unofficial packages) and PHP 7.2 (for official packages). The file extension *.shtml is bound to server side includes which are not enabled per default in most common Linux based distributions. File extension *.pl and *.cgi require additional handlers to be c

    typo3/cms typo3/cmsPHP
    • Update to 8.7.23
    • Update to 9.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. GHSA-g585-crjf-vhwq

    High · CVSS 7.5Fix available

    TYPO3 Denial of Service in Frontend Record Registration

    TYPO3’s built-in record registration functionality (aka `basic shopping cart`) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual session-data records in the database.

    typo3/cms typo3/cmsPHP
    • Update to 7.6.32
    • Update to 8.7.21
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. GHSA-f624-8hfq-5fh3

    Medium · CVSS 5.3Fix available

    TYPO3 Information Disclosure of Installed Extensions

    It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.

    typo3/cms typo3/cmsPHP
    • Update to 8.7.23
    • Update to 9.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. GHSA-c5mj-39cf-3pp5

    High · CVSS 7.3Fix available

    TYPO3 Security Misconfiguration for Backend User Accounts

    When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in order to reflect changed configuration possibilities. However, this leads to persisting the current state as well, which can result into some of the following: - account contains empty login credentials (username and/or password) - account is incomplete and contains weak credentials (username and/or password) Albeit the functionality provided by the TYP

    typo3/cms typo3/cmsPHP
    • Update to 8.7.23
    • Update to 9.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. GHSA-xgmx-j3hv-jh9x

    Medium · CVSS 6.1Fix available

    TYPO3 Cross-Site Scripting in Link Handling

    It has been discovered that `t3://` URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink.

    typo3/cms typo3/cms typo3/cmsPHP
    • Update to 10.2.1
    • Update to 8.7.30
    • Update to 9.5.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. GHSA-772m-43f3-hmf8

    Medium · CVSS 6.5Fix available

    TYPO3 Broken Access Control in Localization Handling

    It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.

    typo3/cmsPHP
    • Update to 8.7.23
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. GHSA-g7hw-jh4p-75wr

    Medium · CVSS 6.1Fix available

    TYPO3 Cross-Site Scripting in Filelist Module

    It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the vulnerability.

    typo3/cms typo3/cms typo3/cmsPHP
    • Update to 10.2.1
    • Update to 8.7.30
    • Update to 9.5.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. GHSA-hh95-5xm5-v8v7

    High · CVSS 8.1Fix available

    TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling

    It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey as secret - invalid or unsigned payload is not deserialized. However, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly known and unprotected backup files), there is the possibility that attackers know the private encryptionKey and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized. Requirements for successfully exploiting this vulnerabilit

    typo3/cms typo3/cmsPHP
    • Update to 8.7.30
    • Update to 9.5.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. GHSA-f5rr-9r84-wwqf

    Not ratedFix available

    Typo3 Broken Access Control in Import Module

    It has been discovered that the Import/Export module is susceptible to broken access control. Regular backend users have access to import functionality which usually only is available to admin users or users having User TSconfig setting options.impexp.enableImportForNonAdminUser explicitly enabled. Database content to be imported however was correctly checked against users’ permissions and not affected. However it was possible to upload files by-passing restrictions of the file abstraction layer (FAL) - however this did not affect executable files which have been correctly secured by fileDenyPattern. Currently the only known vulnerability i

    typo3/cmsPHP
    • Update to 9.5.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →