PT-2025-3144 · Typo3 · Typo3

Gabriel Dimitrov · Published 2025-01-14 · Updated 2025-08-26 · CVE-2024-55893

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS

Description A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptible to Cross-Site Request Forgery (CSRF). State-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend. This can occur when the user opens a malicious link or visits a compromised website while the security.backend.enforceReferrer feature is disabled or the BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component "Log Module" allows attackers to remove log entries.

Recommendations Update to TYPO3 version 11.5.42 ELTS to fix the problem described. Update to TYPO3 version 12.4.25 LTS to fix the problem described. Update to TYPO3 version 13.4.3 LTS to fix the problem described.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

CWE-749

Related Identifiers

CVE-2024-55893

GHSA-CJFR-9F5R-3Q93

Affected Products

Typo3

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55893.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-cjfr-9f5r-3q93 · Vendor Advisory
• https://github.com/TYPO3-CMS/belog/commit/db399b80d94bd174e6699eccaf3fac7772a898a9 · Patch
• https://github.com/TYPO3-CMS/belog/commit/0eb171fcc5863c74f4890af0c6b3ccecb7e30cce · Patch
• https://github.com/TYPO3-CMS/belog/commit/ece08246dbcea416ff97d4cc013bf24fb622fe5f · Patch
• https://osv.dev/vulnerability/GHSA-cjfr-9f5r-3q93 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55893 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2025-003 · Vendor Advisory
• https://github.com/TYPO3-CMS/belog · Note
• https://t.me/cvedetector/15365 · Telegram Post
• https://twitter.com/CVEnew/status/1879290700119863337 · Twitter Post
• https://t.me/cveNotify/133560 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55893 · Note
• https://twitter.com/CVETracker/status/1879619775271194907 · Twitter Post