PT-2025-3143 · Typo3 · Typo3

Christian Eßl + 1 · Published 2025-01-14 · Updated 2025-01-14 · CVE-2024-55892

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 9.5.48 and earlier ELTS, 10.4.47 and earlier ELTS, 11.5.41 and earlier LTS, 12.4.24 and earlier LTS, 13.4.2 and earlier

Description Applications that use TYPO3CMSCoreHttpUri to parse externally provided URLs and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the validation checks.

Recommendations Update to TYPO3 version 9.5.49 ELTS Update to TYPO3 version 10.4.48 ELTS Update to TYPO3 version 11.5.42 LTS Update to TYPO3 version 12.4.25 LTS Update to TYPO3 version 13.4.3

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-55892

GHSA-2FX5-PGGV-6JJR

Affected Products

Typo3

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55892.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-2fx5-pggv-6jjr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2fx5-pggv-6jjr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55892 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2025-002 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/a4abf48d254685f43383e6e7f80d48aebaea56af · Note
• https://twitter.com/CVEnew/status/1879290699117478231 · Twitter Post
• https://t.me/cvedetector/15370 · Telegram Post