We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Ok

THREATINT
PUBLISHED

CVE-2024-34355

TYPO3 vulnerable to an HTML Injection in the History Module

Reserved:2024-05-02
Published:2024-05-14
Updated:2024-05-14

Description

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.



LOW: 3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Problem types

CWE-116: Improper Encoding or Escaping of Output

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

>= 13.0.0, < 13.1.1
affected

References

https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jc

https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375

https://typo3.org/security/advisory/typo3-core-sa-2024-007

cve.org CVE-2024-34355

nvd.nist.gov CVE-2024-34355

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-34355