CVE-2024-34537: Denial of Service in TYPO3 Bookmark Toolbar
Problem Due to insufficient input validation, manipulated data saved in the bookmark toolbar of the backend user interface causes a general error state, blocking further access to the interface. Exploiting this vulnerability requires an administrator-level backend user account.
Solution Update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described.
Credits Thanks to Hendrik Eichner who reported this issue and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References TYPO3-CORE-SA-2024-011
Other sources
Denial of Service in TYPO3 Bookmark Toolbar
— Packagist
TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 10.4.46 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 11.5.40 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 12.4.21 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 13.3.1 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 12.4.20 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 10.4.46 ELTS - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 11.5.40 LTS - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 12.4.21 LTS - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 13.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34537?
CVE-2024-34537 has a high severity due to its potential to disrupt backend access for administrators.
How do I fix CVE-2024-34537?
To fix CVE-2024-34537, update the typo3/cms-backend package to version 10.4.46, 11.5.40, 12.4.21, or 13.3.1.
Who is affected by CVE-2024-34537?
CVE-2024-34537 affects users with an administrator-level backend user account in TYPO3 CMS.
What would an attacker achieve by exploiting CVE-2024-34537?
An attacker exploiting CVE-2024-34537 could cause a general error state, blocking access to the backend interface.
Is user authentication affected by CVE-2024-34537?
Yes, CVE-2024-34537 requires an admin-level account for exploitation, indicating a potential issue with user authentication.