Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-34357

Summary
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
Published At-14 May, 2024 | 14:13
Updated At-02 Aug, 2024 | 02:51
Rejected At-
Credits

TYPO3 vulnerable to Cross-Site Scripting in ShowImageController

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:GitHub_M
Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa
Published At:14 May, 2024 | 14:13
Updated At:02 Aug, 2024 | 02:51
Rejected At:
▼CVE Numbering Authority (CNA)
TYPO3 vulnerable to Cross-Site Scripting in ShowImageController

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

Affected Products
Vendor
TYPO3 AssociationTYPO3
Product
typo3
Versions
Affected
  • >= 9.0.0, < 9.5.48
  • >= 10.0.0, < 10.4.45
  • >= 11.0.0, < 11.5.37
  • >= 12.0.0, < 12.4.15
  • >= 13.0.0, < 13.1.1
Problem Types
TypeCWE IDDescription
CWECWE-79CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Type: CWE
CWE ID: CWE-79
Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Metrics
VersionBase scoreBase severityVector
3.15.4MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Version: 3.1
Base score: 5.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m
x_refsource_CONFIRM
https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7
x_refsource_MISC
https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee
x_refsource_MISC
https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1
x_refsource_MISC
https://typo3.org/security/advisory/typo3-core-sa-2024-009
x_refsource_MISC
Hyperlink: https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7
Resource:
x_refsource_MISC
Hyperlink: https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee
Resource:
x_refsource_MISC
Hyperlink: https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1
Resource:
x_refsource_MISC
Hyperlink: https://typo3.org/security/advisory/typo3-core-sa-2024-009
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m
x_refsource_CONFIRM
x_transferred
https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7
x_refsource_MISC
x_transferred
https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee
x_refsource_MISC
x_transferred
https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1
x_refsource_MISC
x_transferred
https://typo3.org/security/advisory/typo3-core-sa-2024-009
x_refsource_MISC
x_transferred
Hyperlink: https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://typo3.org/security/advisory/typo3-core-sa-2024-009
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-advisories@github.com
Published At:14 May, 2024 | 16:17
Updated At:03 Sep, 2025 | 17:34

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.15.4MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Type: Secondary
Version: 3.1
Base score: 5.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE Matches
TYPO3 Association
typo3
>>typo3>>Versions from 9.0.0(inclusive) to 9.5.48(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
TYPO3 Association
typo3
>>typo3>>Versions from 10.0.0(inclusive) to 10.4.45(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
TYPO3 Association
typo3
>>typo3>>Versions from 11.0.0(inclusive) to 11.5.37(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
TYPO3 Association
typo3
>>typo3>>Versions from 12.0.0(inclusive) to 12.4.15(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
TYPO3 Association
typo3
>>typo3>>Versions from 13.0.0(inclusive) to 13.1.1(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-79Secondarysecurity-advisories@github.com
CWE ID: CWE-79
Type: Secondary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7security-advisories@github.com
Patch
https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15eesecurity-advisories@github.com
Patch
https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1security-advisories@github.com
Patch
https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3msecurity-advisories@github.com
Vendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2024-009security-advisories@github.com
Vendor Advisory
https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7af854a3a-2127-422b-91ae-364da2661108
Patch
https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15eeaf854a3a-2127-422b-91ae-364da2661108
Patch
https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1af854a3a-2127-422b-91ae-364da2661108
Patch
https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3maf854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2024-009af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Hyperlink: https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m
Source: security-advisories@github.com
Resource:
Vendor Advisory
Hyperlink: https://typo3.org/security/advisory/typo3-core-sa-2024-009
Source: security-advisories@github.com
Resource:
Vendor Advisory
Hyperlink: https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch
Hyperlink: https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch
Hyperlink: https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch
Hyperlink: https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Vendor Advisory
Hyperlink: https://typo3.org/security/advisory/typo3-core-sa-2024-009
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found