Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen und um Cross-Site Scripting Angriffe durchzuführen.
Product
TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 8
-
Critical 10.0
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution
The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.
-
High 8.6
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.
-
High 8.6
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference
The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.
-
High 8.6
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
-
Medium 6.8
The Backup Plus extension for TYPO3 (ns_backup) allows command injections
The ns_backup extension through 13.0.0 for TYPO3 allows command injection.
-
Medium 6.4
[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability
The cs_seo extension through 9.2.0 for TYPO3 allows XSS.
-
Medium 6.1
The Backup Plus extension for TYPO3 (ns_backup) allows XSS
The ns_backup extension through 13.0.0 for TYPO3 allows XSS.
-
Medium 5.3
The femanager TYPO3 extension allows Insecure Direct Object Reference
The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-16033, EUVD-2025-16029, EUVD-2025-16030, EUVD-2025-16031
-
#1
Initiale Fassung
References
-
Typo3 Security Advisory vom 2025-05-19
https://typo3.org/security/advisory/typo3-ext-sa-2025-004
-
Typo3 Security Advisory vom 2025-05-19
https://typo3.org/security/advisory/typo3-ext-sa-2025-005
-
Typo3 Security Advisory vom 2025-05-19
https://typo3.org/security/advisory/typo3-ext-sa-2025-006
-
Typo3 Security Advisory vom 2025-05-19
https://typo3.org/security/advisory/typo3-ext-sa-2025-007
-
Typo3 Security Advisory vom 2025-05-19
https://typo3.org/security/advisory/typo3-ext-sa-2025-008