CVE-2024-34356: TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
Problem The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module.
Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.
Credits Thanks to TYPO3 core & security team member Benjamin Franzke who reported and fixed the issue.
References TYPO3-CORE-SA-2024-008
Other sources
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.
— NVD
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.1.1 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.15 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 11.5.37 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 10.4.45 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 9.5.48 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Patch TYPO3-CORE-SA-2024-008
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34356?
CVE-2024-34356 is classified as a medium severity vulnerability due to its cross-site scripting nature.
How do I fix CVE-2024-34356?
To fix CVE-2024-34356, update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, or 13.1.1.
Who can exploit CVE-2024-34356?
CVE-2024-34356 can be exploited by any authenticated backend user with access to the form module.
What type of vulnerability is CVE-2024-34356?
CVE-2024-34356 is a cross-site scripting (XSS) vulnerability.
Which TYPO3 versions are vulnerable to CVE-2024-34356?
TYPO3 versions prior to 9.5.48, 10.4.45, 11.5.37, 12.4.15, and 13.1.1 are affected by CVE-2024-34356.