Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-59014

Summary
Assigner-TYPO3
Assigner Org ID-f4fb688c-4412-4426-b4b8-421ecf27b14a
Published At-09 Sep, 2025 | 09:00
Updated At-09 Sep, 2025 | 19:31
Rejected At-
Credits

Denial of Service in TYPO3 Bookmark Toolbar

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:TYPO3
Assigner Org ID:f4fb688c-4412-4426-b4b8-421ecf27b14a
Published At:09 Sep, 2025 | 09:00
Updated At:09 Sep, 2025 | 19:31
Rejected At:
▼CVE Numbering Authority (CNA)
Denial of Service in TYPO3 Bookmark Toolbar

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

Affected Products
Vendor
TYPO3 AssociationTYPO3
Product
TYPO3 CMS
Collection URL
https://packagist.org
Package Name
typo3/cms-backend
Repo
https://github.com/TYPO3/typo3
Modules
  • Backend
Default Status
unaffected
Versions
Affected
  • From 11.0.0 before 11.5.48 (semver)
  • From 12.0.0 before 12.4.37 (semver)
  • From 13.0.0 before 13.4.18 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-248CWE-248
Type: CWE
CWE ID: CWE-248
Description: CWE-248
Metrics
VersionBase scoreBase severityVector
4.05.1MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Version: 4.0
Base score: 5.1
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
reporter
Jakub Świes
remediation developer
Oliver Hader
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://typo3.org/security/advisory/typo3-core-sa-2025-018
vendor-advisory
Hyperlink: https://typo3.org/security/advisory/typo3-core-sa-2025-018
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:f4fb688c-4412-4426-b4b8-421ecf27b14a
Published At:09 Sep, 2025 | 09:15
Updated At:10 Sep, 2025 | 13:40

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.05.1MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.12.7LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Type: Secondary
Version: 4.0
Base score: 5.1
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 2.7
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CPE Matches
TYPO3 Association
typo3
>>typo3>>Versions from 11.0.0(inclusive) to 11.5.48(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
TYPO3 Association
typo3
>>typo3>>Versions from 12.0.0(inclusive) to 12.4.37(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
TYPO3 Association
typo3
>>typo3>>Versions from 13.0.0(inclusive) to 13.4.18(exclusive)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-248Secondaryf4fb688c-4412-4426-b4b8-421ecf27b14a
CWE ID: CWE-248
Type: Secondary
Source: f4fb688c-4412-4426-b4b8-421ecf27b14a
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://typo3.org/security/advisory/typo3-core-sa-2025-018f4fb688c-4412-4426-b4b8-421ecf27b14a
Vendor Advisory
Hyperlink: https://typo3.org/security/advisory/typo3-core-sa-2025-018
Source: f4fb688c-4412-4426-b4b8-421ecf27b14a
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found