Information Disclosure Vulnerability in TYPO3 CMS Backend
Summary
CVE-2024-47780: Information Disclosure in TYPO3 Page Tree. Affects typo3/cms-backend across 4 version ranges.
>= 10.0.0, < 10.4.46
>= 11.0.0, < 11.5.40
>= 12.0.0, < 12.4.21
>= 13.0.0, < 13.3.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is a powerful open-source content management system (CMS) used for building and managing websites. It offers a wide range of features, including user management, templating, and extensibility through extensions. The TYPO3 CMS Backend is the administrative interface where backend users manage content and settings. This vulnerability affects the backend page tree, potentially exposing restricted pages to unauthorized users.
Vulnerability Detail
The vulnerability allows backend users to see items in the backend page tree without having the necessary access rights. This occurs if the mounts are configured to point to pages that are restricted for their user or group, or if no mounts are configured but the pages are accessible to 'everybody.' Although affected users cannot manipulate these pages, the visibility of restricted content poses a security risk, leading to potential information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.4.4610.4.46composer require typo3/cms-backend:10.4.46 -
>= 11.0.0, < 11.5.4011.5.40composer require typo3/cms-backend:11.5.40 -
>= 12.0.0, < 12.4.2112.4.21composer require typo3/cms-backend:12.4.21 -
>= 13.0.0, < 13.3.113.3.1composer require typo3/cms-backend:13.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as soon as possible.
Conclusion
The information disclosure vulnerability in the TYPO3 CMS Backend poses a risk to backend users by allowing unauthorized visibility of restricted pages. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your TYPO3 installation.
See every vulnerability recorded for typo3/cms-backend →
FAQ
The vulnerability is an information disclosure issue that allows unauthorized visibility of restricted pages in the TYPO3 backend.
Backend users with restricted access rights may be affected as they can see items in the page tree that they should not have access to.
The main consequence is the exposure of sensitive information to unauthorized users, which could lead to data breaches or privacy violations.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 3.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
