PT-2025-3148 · Typo3 · Typo3

Gabriel Dimitrov · Published 2025-01-14 · Updated 2025-08-26 · CVE-2024-55920

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS

Description A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptible to Cross-Site Request Forgery (CSRF). State-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend. This can occur when the user opens a malicious link or visits a compromised website while specific settings are misconfigured, such as the security.backend.enforceReferrer feature being disabled or the BE/cookieSameSite configuration being set to lax or none. The vulnerability in the affected downstream component "Dashboard Module" allows attackers to manipulate the victim's dashboard configuration.

Recommendations Update to TYPO3 version 11.5.42 ELTS to fix the problem described. Update to TYPO3 version 12.4.25 LTS to fix the problem described. Update to TYPO3 version 13.4.3 LTS to fix the problem described.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-749

CWE-352

Related Identifiers

CVE-2024-55920

GHSA-QWX7-39PW-2MHR

Affected Products

Typo3

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55920.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-qwx7-39pw-2mhr · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2025-005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55920 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55920 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qwx7-39pw-2mhr · Vendor Advisory
• https://github.com/TYPO3-CMS/dashboard/commit/c2e5dbdda87387ad9ee2ff8ca986d41dd9424875 · Note
• https://github.com/TYPO3-CMS/dashboard · Note
• https://t.me/cveNotify/133567 · Telegram Post
• https://twitter.com/CVETracker/status/1879619774327464184 · Twitter Post
• https://t.me/cvedetector/15364 · Telegram Post
• https://twitter.com/CVEnew/status/1879290702074352013 · Twitter Post