PT-2025-3152 · Typo3 · Typo3
Gabriel Dimitrov
·
Published
2025-01-14
·
Updated
2025-08-26
·
CVE-2024-55924
CVSS v3.1
8.0
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TYPO3 versions prior to 11.5.42 ELTS
Description
A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptible to Cross-Site Request Forgery (CSRF). State-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend. This can occur when the user opens a malicious link or visits a compromised website while specific settings are misconfigured, such as the
security.backend.enforceReferrer feature being disabled or the BE/cookieSameSite configuration being set to lax or none. The vulnerability in the affected downstream component “Scheduler Module” allows attackers to trigger pre-defined command classes, potentially leading to unauthorized import or export of data.Recommendations
Update to TYPO3 version 11.5.42 ELTS to fix the problem described. As a temporary workaround, consider restricting access to the vulnerable
Scheduler Module until the update is applied. Additionally, ensure that the security.backend.enforceReferrer feature is enabled and the BE/cookieSameSite configuration is set to a secure value to minimize the risk of exploitation.Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Typo3