CVE-2024-34537: TYPO3 cms-backend Denial of Service Vulnerability
Summary
CVE-2024-34537: Denial of Service in TYPO3 Bookmark Toolbar. Affects typo3/cms-backend across 4 version ranges.
>= 10.0.0, < 10.4.46
>= 11.0.0, < 11.5.40
>= 12.0.0, < 12.4.21
>= 13.0.0, < 13.3.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that enables users to create and manage websites efficiently. The 'cms-backend' package is a crucial component of TYPO3, providing the backend user interface for administrators to manage content and settings. This package is widely used in various web applications, making its security paramount. However, it has recently been identified to have a vulnerability that can lead to a Denial of Service (DoS) condition, affecting the accessibility of the backend interface.
Vulnerability Detail
The vulnerability arises from insufficient input validation within the TYPO3 Bookmark Toolbar. When manipulated data is saved by an administrator-level backend user, it can trigger a general error state, effectively blocking further access to the backend interface. This means that an attacker with administrative privileges could exploit this flaw to disrupt the normal functioning of the TYPO3 backend, leading to potential downtime and loss of access for legitimate users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.4.4610.4.46composer require typo3/cms-backend:10.4.46 -
>= 11.0.0, < 11.5.4011.5.40composer require typo3/cms-backend:11.5.40 -
>= 12.0.0, < 12.4.2112.4.21composer require typo3/cms-backend:12.4.21 -
>= 13.0.0, < 13.3.113.3.1composer require typo3/cms-backend:13.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The TYPO3 cms-backend vulnerability (CVE-2024-34537) poses a significant risk of Denial of Service due to insufficient input validation. It is crucial for administrators to update to the patched versions to ensure the security and accessibility of their TYPO3 installations.
See every vulnerability recorded for typo3/cms-backend →
FAQ
CVE-2024-34537 is a vulnerability in the TYPO3 cms-backend package that can lead to a Denial of Service condition due to insufficient input validation.
Any TYPO3 installation using the affected versions of the cms-backend package is at risk, particularly those with administrator-level access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating to the patched versions as soon as possible to mitigate the risk.
The CVSS score of this vulnerability is 2.5, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
