PT-2024-32812 · Typo3 · Typo3

Peter Schuler · Published 2024-10-08 · Updated 2025-09-03 · CVE-2024-47780

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 10.4.46 ELTS TYPO3 versions prior to 11.5.40 LTS TYPO3 versions prior to 12.4.21 LTS TYPO3 versions prior to 13.3.1

Description Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages.

Recommendations Update to version 10.4.46 ELTS to resolve the issue. Update to version 11.5.40 LTS to resolve the issue. Update to version 12.4.21 LTS to resolve the issue. Update to version 13.3.1 to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-47780

GHSA-RF5M-H8Q9-9W6Q

Affected Products

Typo3

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47780.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-rf5m-h8q9-9w6q · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2024-012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47780 · Security Note
• https://osv.dev/vulnerability/GHSA-rf5m-h8q9-9w6q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47780 · Vendor Advisory
• https://github.com/TYPO3-CMS/backend · Note
• https://github.com/TYPO3-CMS/backend/commit/8b024b08a2c7071a2f2ff7c758766e4e9273f83c · Note
• https://github.com/TYPO3-CMS/backend/commit/a7b3c924014ada61632cd5e3fb9825fcc86c5719 · Note
• https://github.com/TYPO3-CMS/backend/commit/9ae1ef969b63292a13f80955a95713cabd45cc22 · Note
• https://twitter.com/VulmonFeeds/status/1844004709448679918 · Twitter Post
• https://t.me/cveNotify/134220 · Telegram Post
• https://twitter.com/CVEnew/status/1843718337794322604 · Twitter Post
• https://t.me/cvedetector/7398 · Telegram Post