CVE-2024-22188
EUVD-2024-052505.03.2024, 02:15
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| typo3 | typo3 | 8.0.0 ≤ 𝑥 < 8.7.57 |
| typo3 | typo3 | 9.0.0 ≤ 𝑥 < 9.5.46 |
| typo3 | typo3 | 10.0.0 ≤ 𝑥 < 10.4.43 |
| typo3 | typo3 | 11.0.0 ≤ 𝑥 < 11.5.35 |
| typo3 | typo3 | 12.0.0 ≤ 𝑥 < 12.4.11 |
| typo3 | typo3 | 13.0.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| typo3 | typo3 | 8.0.0 ≤ 𝑥 ≤ 8.7.56 | ADP |
| typo3 | typo3 | 9.0.0 ≤ 𝑥 ≤ 9.5.45 | ADP |
| typo3 | typo3 | 10.0.0 ≤ 𝑥 ≤ 10.4.42 | ADP |
| typo3 | typo3 | 11.0.0 ≤ 𝑥 ≤ 11.5.34 | ADP |
| typo3 | typo3 | 12.0.0 ≤ 𝑥 ≤ 12.4.10 | ADP |
References