CVE-2024-25120: Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3

Published Feb 13, 2024
·
Updated

Problem The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account.

Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.

Credits Thanks to Richie Lee who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue.

References TYPO3-CORE-SA-2024-005

Other sources

TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.

— NVD

Affected Software

12 affected componentsFixes available
composer/typo3/cms-core=13.0.0
13.0.1
composer/typo3/cms-core>=12.0.0<=12.4.10
12.4.11
composer/typo3/cms-core>=11.0.0<=11.5.34
11.5.35
composer/typo3/cms-core>=10.0.0<=10.4.42
10.4.43
composer/typo3/cms-core>=9.0.0<=9.5.45
9.5.46
composer/typo3/cms-core>=8.0.0<=8.7.56
8.7.57
Typo3 TYPO3>=8.0.0<8.7.57
Typo3 TYPO3>=9.0.0<9.5.46
Typo3 TYPO3>=10.0.0<10.4.43
Typo3 TYPO3>=11.0.0<11.5.35
Typo3 TYPO3>=12.0.0<12.4.11
Typo3 TYPO3=13.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade composer/typo3/cms-core to a version that resolves this vulnerability.

    Fixed in 13.0.1
  2. Upgrade

    Upgrade composer/typo3/cms-core to a version that resolves this vulnerability.

    Fixed in 12.4.11
  3. Upgrade

    Upgrade composer/typo3/cms-core to a version that resolves this vulnerability.

    Fixed in 11.5.35
  4. Upgrade

    Upgrade composer/typo3/cms-core to a version that resolves this vulnerability.

    Fixed in 10.4.43
  5. Upgrade

    Upgrade composer/typo3/cms-core to a version that resolves this vulnerability.

    Fixed in 9.5.46
  6. Upgrade

    Upgrade composer/typo3/cms-core to a version that resolves this vulnerability.

    Fixed in 8.7.57
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch TYPO3-CORE-SA-2024-005
  8. Upgrade

    Upgrade TYPO3 to a version that resolves this vulnerability.

    Fixed in 8.7.57 ELTS
  9. Upgrade

    Upgrade TYPO3 to a version that resolves this vulnerability.

    Fixed in 9.5.46 ELTS
  10. Upgrade

    Upgrade TYPO3 to a version that resolves this vulnerability.

    Fixed in 10.4.43 ELTS
  11. Upgrade

    Upgrade TYPO3 to a version that resolves this vulnerability.

    Fixed in 11.5.35 LTS
  12. Upgrade

    Upgrade TYPO3 to a version that resolves this vulnerability.

    Fixed in 12.4.11 LTS
  13. Upgrade

    Upgrade TYPO3 to a version that resolves this vulnerability.

    Fixed in 13.0.1

Event History

Feb 13, 2024
Advisory Published
via GitHub·05:24 PM
CVE Published
via MITRE·10:15 PM
Data Sourced
via MITRE·10:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
Affected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-25120?

CVE-2024-25120 has a medium severity rating due to the potential for unauthorized access to resources.

2

How do I fix CVE-2024-25120?

To fix CVE-2024-25120, update to TYPO3 versions 13.0.1, 12.4.11, 11.5.35, 10.4.43, 9.5.46, or 8.7.57.

3

What impact does CVE-2024-25120 have on TYPO3 installations?

CVE-2024-25120 allows access to files, folders, pages, and records beyond a user's permission scope, posing a security risk.

4

Which TYPO3 versions are affected by CVE-2024-25120?

CVE-2024-25120 affects TYPO3 versions 8.0.0 to 13.0.0.

5

Is CVE-2024-25120 related to a specific TYPO3 functionality?

CVE-2024-25120 is related to the TYPO3-specific 't3://' URI scheme that can be exploited to access restricted resources.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2024-25120 - Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3 - SecAlerts