CVE-2009-3630: TYPO3 Backend vulnerable to Frame Hijacking
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to place arbitrary web sites in TYPO3 backend framesets via crafted parameters, related to a "frame hijacking" issue.
Other sources
TYPO3 Backend vulnerable to Frame Hijacking
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.3beta2 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.2.10 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.1.13
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3630?
CVE-2009-3630 is classified as a vulnerability that allows remote authenticated users to perform frame hijacking within the TYPO3 backend.
How do I fix CVE-2009-3630?
To fix CVE-2009-3630, update TYPO3 to version 4.3beta2 or later, 4.2.10, or 4.1.13.
Which versions of TYPO3 are affected by CVE-2009-3630?
CVE-2009-3630 affects TYPO3 versions up to and including 4.3beta1, as well as versions 4.0.13 and earlier.
Can CVE-2009-3630 be exploited by unauthenticated users?
No, CVE-2009-3630 requires authentication, thus only remote authenticated users can exploit this vulnerability.
What type of attack does CVE-2009-3630 facilitate?
CVE-2009-3630 facilitates a frame hijacking attack by allowing malicious framed content to be displayed within the TYPO3 backend.