PT-2024-25812 · Typo3 · Typo3

Andreas Kienast · Published 2024-05-14 · Updated 2025-01-21 · CVE-2024-34355

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 13.0.0 through 13.1.0

Description The history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this issue requires a valid backend user account.

Recommendations Update to TYPO3 version 13.1.1 to fix the problem.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2024-34355

GHSA-XJWX-78X7-Q6JC

Affected Products

Typo3

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34355.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jc · Vendor Advisory
• https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375 · Patch
• https://osv.dev/vulnerability/CVE-2024-34355 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2024-007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34355 · Security Note
• https://osv.dev/vulnerability/GHSA-xjwx-78x7-q6jc · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://twitter.com/oktsec/status/1810209589255602260 · Twitter Post
• https://t.me/cvenotify/108054 · Telegram Post