CVE-2024-34357
14.05.2024, 16:17
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
| Vendor | Product | Version |
|---|---|---|
| typo3 | typo3 | 9.0.0 ≤ 𝑥 < 9.5.48 |
| typo3 | typo3 | 10.0.0 ≤ 𝑥 < 10.4.45 |
| typo3 | typo3 | 11.0.0 ≤ 𝑥 < 11.5.37 |
| typo3 | typo3 | 12.0.0 ≤ 𝑥 < 12.4.15 |
| typo3 | typo3 | 13.0.0 ≤ 𝑥 < 13.1.1 |
𝑥
= Vulnerable software versions
References