Skip to content
OpenAdvisories
Medium WID-SEC-2023-2883 3 CVEs

TYPO3 Core: Mehrere Schwachstellen

Published Nov 13, 2023 · Updated Nov 14, 2023 · Revision 2 · de-DE

Vendor: TYPO3 Product: Core Product: Core < 10.4.41 ELTS Product: Core < 11.5.33 Product: Core < 12.4.8 Product: Core < 8.7.55 ELTS Product: Core < 9.5.44 ELTS Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • Medium 4.7
    CVE-2023-47125 Public exploit

    By-passing Cross-Site Scripting Protection in HTML Sanitizer

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vuln…

    TYPO3 HTML Sanitizer typo3/html-sanitizer Packagist
  • Medium 4.2
    CVE-2023-47127

    Weak Authentication in Session Handling in typo3/cms-core

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist
  • Low 3.7
    CVE-2023-47126

    Information Disclosure in Install Tool in typo3/cms-install

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This …

    TYPO3 typo3 typo3/cms-install Web / CMS Packagist

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References