Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvc - https://github.com/thorsten/phpMyFAQ/commit/fa0f7368dc3288eedb1915def64ef8fb270f711d
CVE ID: CVE-2024-55890 State: PUBLISHED Published: 2024-12-13T18:00:04.173Z Last Updated: 2024-12-13T18:48:43.721Z Vendors: man-group Products: dtale Problem Types: CWE-79 Description: D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
than 3.16.1 is to only host D-Tale to trusted users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/man-group/dtale/security/advisories/GHSA-832w-fhmw-w4f4 - https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a - https://github.com/man-group/dtale#custom-filter
CVE ID: CVE-2024-55891 State: PUBLISHED Published: 2025-01-14T19:11:58.861Z Last Updated: 2025-01-15T15:02:46.106Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-532 Description: TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the problem described. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github
nown workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-38x7-cc6w-j27q - https://typo3.org/security/advisory/typo3-core-sa-2025-001
CVE ID: CVE-2024-55892 State: PUBLISHED Published: 2025-01-14T20:01:55.952Z Last Updated: 2025-01-14T20:13:02.579Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-601 Description: TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a query parameter) and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the validation checks. Users are advised to update to TYPO3 versions 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, 13.4.3 which fix the prob
s are advised to update to TYPO3 versions 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, 13.4.3 which fix the problem described. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-2fx5-pggv-6jjr - https://typo3.org/security/advisory/typo3-core-sa-2025-002
CVE ID: CVE-2024-55893 State: PUBLISHED Published: 2025-01-14T20:00:15.247Z Last Updated: 2025-05-20T18:20:53.394Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of th
rrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Log Module” allows att
ite` configuration is set to lax or none. The vulnerability in the affected downstream component “Log Module” allows attackers to remove log entries. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-cjfr-9f5r-3q93 - https://github.com/TYPO3-CMS/belog/commit/0eb171fcc5863c74f4890af0c6b3ccecb7e30cce - https://github.com/TYPO3-CMS/belog/commit/db399b80d94bd174e6699eccaf3fac7772a898a9 - https://github.com/TYPO3-CMS/belog/commit/ece08246dbcea416ff97d4cc013b
commit/db399b80d94bd174e6699eccaf3fac7772a898a9 - https://github.com/TYPO3-CMS/belog/commit/ece08246dbcea416ff97d4cc013bf24fb622fe5f - https://typo3.org/security/advisory/typo3-core-sa-2025-003
CVE ID: CVE-2024-55894 State: PUBLISHED Published: 2025-01-14T19:57:28.172Z Last Updated: 2025-05-20T17:58:00.457Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of th
rrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Backend User Module” a
ite` configuration is set to lax or none. The vulnerability in the affected downstream component “Backend User Module” allows attackers to initiate password resets for other backend users or to terminate their user sessions. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-6w4x-gcx3-8p7v - https://github.com/TYPO3-CMS/beuser/commit/18603efc3a66d3255fdd04eb6bda6b4d6a95abea - https://github.com/TYPO3-CMS/beuser/commit/1bb317cb2bc0b2f6ba4f758a088f060b36c67f9d - https://github.com/TYPO3-CMS/beuser/commit/41421
.com/TYPO3-CMS/beuser/commit/1bb317cb2bc0b2f6ba4f758a088f060b36c67f9d - https://github.com/TYPO3-CMS/beuser/commit/4142112a878f8805234729751bc6b9c0091560ab - https://typo3.org/security/advisory/typo3-core-sa-2025-004
CVE ID: CVE-2024-55895 State: PUBLISHED Published: 2025-03-29T12:22:50.518Z Last Updated: 2025-09-01T00:59:33.963Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-209 Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185450
CVE ID: CVE-2024-55896 State: PUBLISHED Published: 2025-01-03T22:27:43.940Z Last Updated: 2025-01-06T16:33:47.226Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: i Problem Types: CWE-451 Description: IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to gain improper access and perform unauthorized actions on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180036
CVE ID: CVE-2024-55897 State: PUBLISHED Published: 2025-01-03T22:28:38.502Z Last Updated: 2025-03-13T15:54:02.868Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: i Problem Types: 614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Description: IBM PowerHA SystemMirror for i 7.4 and 7.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analys
e sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180036
CVE ID: CVE-2024-55898 State: PUBLISHED Published: 2025-02-24T02:01:55.854Z Last Updated: 2025-02-24T11:43:23.153Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: CWE-427 Description: IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183835
CVE ID: CVE-2024-55904 State: PUBLISHED Published: 2025-02-14T03:23:49.065Z Last Updated: 2025-02-14T14:46:04.073Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: UrbanCode Deploy, DevOps Deploy Problem Types: CWE-78 Description: IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 / IBM UrbanCode Deploy 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.9 could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/supp
t containing special elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182841
CVE ID: CVE-2024-55907 State: PUBLISHED Published: 2025-03-02T15:22:59.258Z Last Updated: 2025-09-01T01:09:49.562Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: CWE-540 Description: IBM Cognos Analytics Mobile 1.1 for iOS application could allow an attacker to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used due to weak obfuscation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184429
CVE ID: CVE-2024-55909 State: PUBLISHED Published: 2025-05-02T00:35:26.694Z Last Updated: 2025-08-28T14:28:56.414Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Concert Software Problem Types: CWE-409 Description: IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlling resource consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232169
CVE ID: CVE-2024-55910 State: PUBLISHED Published: 2025-05-02T00:39:09.289Z Last Updated: 2025-08-28T14:59:19.077Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-918 Description: IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232169
CVE ID: CVE-2024-55912 State: PUBLISHED Published: 2025-05-02T00:36:49.658Z Last Updated: 2025-08-28T14:29:12.519Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-327 Description: IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232169
CVE ID: CVE-2024-55913 State: PUBLISHED Published: 2025-05-02T00:38:03.219Z Last Updated: 2025-08-28T14:58:53.480Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-22 Description: IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232169
CVE ID: CVE-2024-55916 State: PUBLISHED Published: 2025-01-11T12:35:44.800Z Last Updated: 2025-11-03T20:48:52.286Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is fully initialized, we can hit the panic below: hv_utils: Registering HyperV Utility Driver hv_vmbus: registering driver hv_utils ... BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1 RIP: 0010:hv_pkt_iter_first+0x12/0xd0 Call Trace: ... vmbus_
0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1 RIP: 0010:hv_pkt_iter_first+0x12/0xd0 Call Trace: ... vmbus_recvpacket hv_kvp_onchannelcallback vmbus_on_event tasklet_action_common tasklet_action handle_softirqs irq_exit_rcu sysvec_hyperv_stimer0 </IRQ> <TASK> asm_sysvec_hyperv_stimer0 ... kvp_register_done hvt_op_read vfs_read ksys_read __x64_sys_read This can happen because the KVP/VSS channel callback can be invoked even before the channel is fully opened: 1) as soon as hv_kvp_init() -> hvutil_transport_init() creates /dev/vmbus/hv_kvp, the kvp daemon can open the device file immediately and register itself to the driver by writing a message KVP_OP_REGISTER1 to the file (which
n the device file immediately and register itself to the driver by writing a message KVP_OP_REGISTER1 to the file (which is handled by kvp_on_msg() ->kvp_handle_handshake()) and reading the file for the driver's response, which is handled by hvt_op_read(), which calls hvt->on_read(), i.e. kvp_register_done(). 2) the problem with kvp_register_done() is that it can cause the channel callback to be called even before the channel is fully opened, and when the channel callback is starting to run, util_probe()-> vmbus_open() may have not initialized the ringbuffer yet, so the callback can hit the panic of NULL pointer dereference. To reproduce the panic consistently, we can add a "ssleep(10)" for
lback can hit the panic of NULL pointer dereference. To reproduce the panic consistently, we can add a "ssleep(10)" for KVP in __vmbus_open(), just before the first hv_ringbuffer_init(), and then we unload and reload the driver hv_utils, and run the daemon manually within the 10 seconds. Fix the panic by reordering the steps in util_probe() so the char dev entry used by the KVP or VSS daemon is not created until after vmbus_open() has completed. This reordering prevents the race condition from happening. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f091a224a2c82f1e302b1768d73bb6332f687321 - https://git.kernel.org/st
iner: References: - https://git.kernel.org/stable/c/f091a224a2c82f1e302b1768d73bb6332f687321 - https://git.kernel.org/stable/c/d81f4e73aff9b861671df60e5100ad25cc16fbf8 - https://git.kernel.org/stable/c/042253c57be901bfd19f15b68267442b70f510d5 - https://git.kernel.org/stable/c/718fe694a334be9d1a89eed22602369ac18d6583 - https://git.kernel.org/stable/c/89fcec5e466b3ac9b376e0d621c71effa1a7983f - https://git.kernel.org/stable/c/3dd7a30c6d7f90afcf19e9b072f572ba524d7ec6 - https://git.kernel.org/stable/c/07a756a49f4b4290b49ea46e089cbe6f79ff8d26
CVE ID: CVE-2024-55917 State: PUBLISHED Published: 2024-12-31T16:16:43.723Z Last Updated: 2024-12-31T17:24:52.128Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One, Trend Micro Apex One as a Service Problem Types: CWE-346 Description: An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.co
ploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0018217
CVE ID: CVE-2024-55918 State: PUBLISHED Published: 2024-12-13T00:00:00 Last Updated: 2024-12-17T19:34:50.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML injection by an attacker who can create a file in the current working directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rt.cpan.org/Public/Bug/Display.html?id=54500 - https://metacpan.org/release/RRWO/Graphics-ColorNames-v3.2.0/changes - https://metacpan.org/dist/Graphics-ColorNames
CVE ID: CVE-2024-55920 State: PUBLISHED Published: 2025-01-14T19:55:42.459Z Last Updated: 2025-01-15T15:47:07.282Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of th
rrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Dashboard Module” allo
ite` configuration is set to lax or none. The vulnerability in the affected downstream component “Dashboard Module” allows attackers to manipulate the victim’s dashboard configuration. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-qwx7-39pw-2mhr - https://typo3.org/security/advisory/typo3-core-sa-2025-005
CVE ID: CVE-2024-55921 State: PUBLISHED Published: 2025-01-14T19:36:32.439Z Last Updated: 2025-01-15T15:49:28.970Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this
ectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module
e` configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-4g52-pq8j-6qv5 - https://typo3.org/security/advisory/typo3-core-sa-2025-006
CVE ID: CVE-2024-55922 State: PUBLISHED Published: 2025-01-14T19:23:16.769Z Last Updated: 2025-01-14T19:42:15.075Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of th