TYPO3 CMS-Core: Cross-Site Scripting in Form Manager Module
Summary
CVE-2024-34356: TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module. Affects typo3/cms-core across 5 version ranges.
>= 9.0.0, < 9.5.48
>= 10.0.0, < 10.4.45
>= 11.0.0, < 11.5.37
>= 12.0.0, < 12.4.15
>= 13.0.0, < 13.1.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Core is an open-source content management system that allows users to create and manage websites. The Form Manager Module is a backend module that enables administrators to create and manage forms on their TYPO3 websites.
Vulnerability Detail
The Form Manager Module in TYPO3 CMS-Core is vulnerable to cross-site scripting (XSS) attacks. This vulnerability can be exploited by an attacker with a valid backend user account and access to the form module. By injecting malicious scripts into the form fields, an attacker can execute arbitrary code in the context of the affected user's browser. This can lead to various security risks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.489.5.48composer require typo3/cms-core:9.5.48 -
>= 10.0.0, < 10.4.4510.4.45composer require typo3/cms-core:10.4.45 -
>= 11.0.0, < 11.5.3711.5.37composer require typo3/cms-core:11.5.37 -
>= 12.0.0, < 12.4.1512.4.15composer require typo3/cms-core:12.4.15 -
>= 13.0.0, < 13.1.113.1.1composer require typo3/cms-core:13.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating TYPO3 to the recommended versions.
Conclusion
The Form Manager Module in TYPO3 CMS-Core is vulnerable to cross-site scripting (XSS) attacks. It is crucial to update TYPO3 to the recommended versions to patch the vulnerability and protect the system from potential exploits. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS-Core is an open-source content management system used for creating and managing websites.
The Form Manager Module is a backend module in TYPO3 CMS-Core that allows administrators to create and manage forms on their websites.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the affected user's browser. This can lead to various security risks, such as stealing sensitive information or performing actions on behalf of the user.
To fix this vulnerability, update TYPO3 to the latest recommended versions: 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, or 13.1.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
