Skip to content
OpenAdvisories
Medium WID-SEC-2025-1106 6 CVEs

TYPO3 Core: Mehrere Schwachstellen

Published May 19, 2025 · Updated May 20, 2025 · Revision 2 · de-DE

Vendor: TYPO3 Product: Core Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Dateien zu manipulieren, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service auszulösen oder seine Privilegien zu erweitern.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 6

  • High 7.2
    CVE-2025-47940

    TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer

    TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, administrator-level backend users without system maintainer privileges can escalate th…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist
  • High 7.2
    CVE-2025-47941

    TYPO3 Has Broken Authentication in Backend MFA

    TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication (MFA) dialog presented during backend login can be bypassed due to in…

    TYPO3 typo3 typo3/cms-backend Web / CMS Packagist
  • Medium 5.4
    CVE-2025-47939

    TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer

    TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web s…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist
  • Low 3.8
    CVE-2025-47938

    TYPO3 Vulnerable to Unverified Password Change for Backend Users

    TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, the backend user management interface allows password changes without requ…

    TYPO3 typo3 typo3/cms-core typo3/cms-setup Web / CMS Packagist
  • Low 3.7
    CVE-2025-47937

    TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling

    TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the dat…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist
  • Low 3.3
    CVE-2025-47936

    TYPO3 Vulnerable to Server Side Request Forgery via Webhooks

    TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, Webhooks are inherently vulnerable to Cross-Site Request Forgery (CSRF), which can be exploited by a…

    TYPO3 typo3 typo3/cms-webhooks Web / CMS Packagist

Revision history

  1. #2

    Korrektur

  2. #1

    Initiale Fassung

References