CVE-2023-24814: XSS
First published: Tue Feb 07 2023(Updated: )
TYPO3-CORE-SA-2023-001: Persisted Cross-Site Scripting in Frontend Rendering
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms | >=10.0.0<10.4.35>=11.0.0<11.5.23>=12.0.0<12.2.0 | |
| composer/typo3/cms-core | >=10.0.0<10.4.35>=11.0.0<11.5.23>=12.0.0<12.2.0 | |
| Typo3 Typo3 | >=8.7.0<9.7.51 | |
| Typo3 Typo3 | >=9.0.0<9.5.40 | |
| Typo3 Typo3 | >=10.0.0<10.4.36 | |
| Typo3 Typo3 | >=11.0.0<11.5.23 | |
| Typo3 Typo3 | >=12.0.0<12.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://typo3.org/security/advisory/typo3-core-sa-2023-001
- https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Setup/Config/Index.html#absrefprefix
- https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/core/Classes/Utility/GeneralUtility.php#L2481-L2484
- https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php#L2547-L2549
- https://github.com/TYPO3/typo3/commit/0005a6fd86ab97eff8bf2e3a5828bf0e7cb6263a
- https://github.com/TYPO3/typo3/security/advisories/GHSA-r4f8-f93x-5qh3
- https://typo3.org/security/advisory/typo3-psa-2023-001
Frequently Asked Questions
What is TYPO3-CORE-SA-2023-001?
TYPO3-CORE-SA-2023-001 is a vulnerability in TYPO3 that allows attackers to inject malicious content through the unfiltered server environment variable PATH_INFO in the GeneralUtility::getIndpEnv() component.
How does the TYPO3-CORE-SA-2023-001 vulnerability affect software versions?
The TYPO3-CORE-SA-2023-001 vulnerability affects TYPO3 versions 8.7.0 to 9.7.51, 9.0.0 to 9.5.40, 10.0.0 to 10.4.35, 11.0.0 to 11.5.23, and 12.0.0 to 12.2.0.
What is the severity of the TYPO3-CORE-SA-2023-001 vulnerability?
The severity of the TYPO3-CORE-SA-2023-001 vulnerability is rated as high, with a severity value of 6.1.
How can I fix the TYPO3-CORE-SA-2023-001 vulnerability?
To fix the TYPO3-CORE-SA-2023-001 vulnerability, update TYPO3 CMS or TYPO3 CMS-Core to versions 10.4.36, 11.5.24, or 12.2.1, or apply the provided patches.
Where can I find more information about the TYPO3-CORE-SA-2023-001 vulnerability?
More information about the TYPO3-CORE-SA-2023-001 vulnerability can be found in the TYPO3 security advisory TYPO3-CORE-SA-2023-001, the TYPO3 documentation, and the TYPO3 GitHub repository.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/friends-of-php
- collector/nvd-index
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/8.7.0
- version/typo3 typo3/9.0.0
- version/typo3 typo3/10.0.0
- version/typo3 typo3/11.0.0
- version/typo3 typo3/12.0.0