Description
TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | typo3 | >= 13.0.0, < 13.1.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms-core | >= 13.0.0, < 13.1.1 | 13.1.1 | GHSA-xjwx-78x7-q6jc |
Advisories 1
- WID-SEC-2024-1112 TYPO3 Core: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 13, 2024