PT-2024-19263 · Typo3 · Typo3

Daniel Jonka + 1 · Published 2024-02-13 · Updated 2025-09-15 · CVE-2024-22188

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 8.7.0 through 8.7.56 ELTS TYPO3 versions 9.5.0 through 9.5.45 ELTS TYPO3 versions 10.4.0 through 10.4.42 ELTS TYPO3 versions 11.5.0 through 11.5.34 LTS TYPO3 versions 12.4.0 through 12.4.10 LTS TYPO3 versions prior to 13.0.1

Description The issue allows an authenticated admin user with system maintainer privileges to execute arbitrary shell commands with the privileges of the web server via a command injection vulnerability in form fields of the Install Tool. This requires an administrator-level backend user account with system maintainer permissions.

Recommendations Update to TYPO3 version 8.7.57 ELTS Update to TYPO3 version 9.5.46 ELTS Update to TYPO3 version 10.4.43 ELTS Update to TYPO3 version 11.5.35 LTS Update to TYPO3 version 12.4.11 LTS Update to TYPO3 version 13.0.1

Fix

Command Injection

Code Injection

Weakness Enumeration

CWE-77

CWE-94

Related Identifiers

CVE-2024-22188

GHSA-5W2H-59J3-8X5W

Affected Products

Typo3

References · 15

• https://github.com/TYPO3/typo3/security/advisories/GHSA-5w2h-59j3-8x5w · Vendor Advisory
• https://typo3.org/help/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22188 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22188 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2024-002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5w2h-59j3-8x5w · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/6cc11761b8e2434fa4ccc9f096c65ca82569cfdf · Note
• https://github.com/TYPO3/typo3/commit/47e897f8c7668ef299ecc9ce93f52cafbb3497ed · Note
• https://github.com/TYPO3/typo3/commit/84e07e35b880a544b517868432c56987d05d46d4 · Note
• https://t.me/cveNotify/135498 · Telegram Post
• https://t.me/cvenotify/97085 · Telegram Post
• https://typo3.org/security/advisory/typo3-psa-2020-002 · Note
• https://twitter.com/VulmonFeeds/status/1764905554533568516 · Twitter Post
• https://t.me/cvenotify/92504 · Telegram Post