TYPO3 is susceptible to Cross-Site Flashing
The flashplayer misses to validate flash and image files. Therefore it is possible to embed flash videos from external domains.
- Обновитесь до 6.2.16
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости typo3/cms · Страница 4
За последние 30 дней в typo3/cms опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 188
Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend
Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.
- Обновитесь до 6.2.16
- Обновитесь до 7.6.1
Опубликовано ОбновленоTYPO3 Frontend vulnerable to Unauthenticated Path Disclosure
It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation.
- Обновитесь до 6.2.15
- Обновитесь до 7.4.0
Опубликовано ОбновленоTYPO3 Brute Force Protection Bypass in backend login
The backend login has a basic brute force protection implementation which pauses for 5 seconds if wrong credentials are given. This pause however could be bypassed by forging a special request, making brute force attacks on backend editor credentials more feasible.
- Обновитесь до 6.2.14
- Обновитесь до 7.3.1
Опубликовано ОбновленоTYPO3 Information Disclosure Vulnerability Exploitable by Editors
It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.
- Обновитесь до 6.2.14
- Обновитесь до 7.3.1
Опубликовано ОбновленоTYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors
It has been discovered that link tags generated by typolink functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability. As second and separate vulnerability in the filelist module of the backend user interface has been referenced with this advisory as well. Error messages being shown after using a malicious name for renaming a file are not propery encoded, thus vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.
- Обновитесь до 6.2.14
- Обновитесь до 7.3.1
Опубликовано ОбновленоTYPO3 frontend login vulnerable to Session Fixation
It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session.
- Обновитесь до 6.2.14
- Обновитесь до 7.3.1
Опубликовано ОбновленоTYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
- Обновитесь до 6.2.14
- Обновитесь до 7.3.1
Опубликовано ОбновленоTYPO3 possible cache poisoning on the homepage when anchors are used
A request URL with arbitrary arguments, but still pointing to the home page of a TYPO3 installation can be cached if the configuration option config.prefixLocalAnchors is used with the values "all" or "cached". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page.
- Обновитесь до 6.2.9
- Обновитесь до 7.0.2
Опубликовано ОбновленоExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting
Failing to properly validate the HTTP host-header TYPO3 CMS is susceptible to host spoofing. TYPO3 uses the HTTP host-header to generate absolute URLs in several places like 404 handling, http(s) enforcement, password reset links and many more. Since the host header itself is provided by the client it can be forged to any value, even in a name based virtual hosts environment. A blog post describes this problem in great detail.
- Обновитесь до 4.5.34
- Обновитесь до 4.7.19
- Обновитесь до 6.1.9
- Обновитесь до 6.2.3
Опубликовано ОбновленоTYPO3 Arbitrary Shell Execution in Swiftmailer library
The swiftmailer library in use allows to execute arbitrary shell commands if the "From" header comes from a non-trusted source and no "Return-Path" is configured. Affected are only TYPO3 installation the configuration option ``` $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport'] ``` is set to "sendmail". Installations with the default configuration are not affected.
- Обновитесь до 4.5.37
- Обновитесь до 4.7.20
- Обновитесь до 6.1.12
- Обновитесь до 6.2.6
Опубликовано ОбновленоPath Traversal in TYPO3 Core
Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence.
- Обновитесь до 6.2.29
- Обновитесь до 7.6.13
- Обновитесь до 8.4.1
Опубликовано ОбновленоPersisted Cross-Site Scripting in Frontend Rendering in typo3
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML code to pages that have not been rendered and cached, yet. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of `GeneralUtili
- Обновитесь до 10.4.35
- Обновитесь до 11.5.23
- Обновитесь до 12.2.0
Опубликовано ОбновленоTYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Обновитесь до 10.4.33
- Обновитесь до 11.5.20
- Обновитесь до 12.1.1
Опубликовано ОбновленоTYPO3 vulnerable to Arbitrary Code Execution via Form Framework
TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1
- Обновитесь до 10.4.33
- Обновитесь до 11.5.20
- Обновитесь до 12.1.1
Опубликовано ОбновленоTYPO3 contains Insufficient Session Expiration after Password Reset
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.
- Обновитесь до 10.4.33
- Обновитесь до 11.5.20
- Обновитесь до 12.1.1
Опубликовано ОбновленоTYPO3 vulnerable to Improper Authentication in Frontend Login
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
- Обновитесь до 10.4.33
- Обновитесь до 11.5.20
- Обновитесь до 12.1.1
Опубликовано ОбновленоTYPO3 subject to Uncontrolled Recursion resulting in Denial of Service
TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.
- Обновитесь до 10.4.33
- Обновитесь до 11.5.20
Опубликовано ОбновленоCVE-2022-47406
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
- Обновитесь до 2.0.5
- Обновитесь до 3.0.3
Опубликовано ОбновленоCross-Site Scripting Protection bypass in HTML Sanitizer
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (`script`, `style`, `noframes`, `noembed` and `iframe`) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined
- Обновитесь до 10.4.33
- Обновитесь до 11.5.20
- Обновитесь до 12.1.1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.