CVE-2024-34356
Assigner: GitHub_M
Published: 2024-05-14T14:05:19.851Z
State: PUBLISHED
title: TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
problemTypes: descriptions: cweId: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
affected: vendor: TYPO3
product: typo3
versions: version: >= 9.0.0, < 9.5.48
status: affected
version: >= 10.0.0, < 10.4.45
status: affected
version: >= 11.0.0, < 11.5.37
status: affected
version: >= 12.0.0, < 12.4.15
status: affected
version: >= 13.0.0, < 13.1.1
status: affected
descriptions: value: TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.
source: advisory: GHSA-v6mw-h7w6-59w3
discovery: UNKNOWN