Skip to content
OpenAdvisories
Medium WID-SEC-2025-0055 10 CVEs

TYPO3 Core: Mehrere Schwachstellen

Published Jan 13, 2025 · Updated Jan 13, 2025 · de-DE

Vendor: TYPO3 Product: Core Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen preiszugeben.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 10

  • High 8.0
    CVE-2024-55924

    Cross-Site Request Forgery in Scheduler Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-scheduler Web / CMS Packagist
  • High 7.5
    CVE-2024-55921

    Cross-Site Request Forgery in Extension Manager Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-extensionmanager Web / CMS Packagist
  • Medium 5.4
    CVE-2024-55922

    Cross-Site Request Forgery in Form Framework Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-form Web / CMS Packagist
  • Medium 4.8
    CVE-2024-55892

    Potential Open Redirect via Parsing Differences in TYPO3

    TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a query parameter) and validate the host of the parsed URL may be vulnerable to open redirect or SSRF at…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55893

    TYPO3 Cross-Site Request Forgery in Log Module

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-belog Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55894

    TYPO3 Cross-Site Request Forgery in Backend User Module

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-beuser Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55920

    Cross-Site Request Forgery in Dashboard Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-dashboard Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55923

    Cross-Site Request Forgery in Indexed Search Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-indexed-search Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55945

    Cross-Site Request Forgery in DB Check Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-lowlevel Web / CMS Packagist
  • Low 3.1
    CVE-2024-55891

    Information Disclosure via Exception Handling/Logger in TYPO3

    TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 v…

    TYPO3 typo3 typo3/cms-install Web / CMS Packagist

Revision history

  1. #1

    Initiale Fassung

References