125 matches found
Typo3 Cross-Site Scripting in Language Pack Handling
Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting...
GHSA-259V-XM34-P7FR Typo3 Cross-Site Scripting in Language Pack Handling
Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting...
Sensitive Information Disclosure
typo3/cms-core is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the Install Tool exposing the current TYPO3 version number to non-authenticated users...
Session Hijacking
typo3/cms-core is vulnerable to Session Hijacking. The vulnerability is due to cookies not being configured to be submitted only via HTTP, which, when combined with other vulnerabilities such as cross-site scripting, can lead to hijacking an active and valid session via the Install Tool...
TYPO3 Cross-Site Scripting in Language Pack Handling
Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting...
GHSA-76R3-M635-P3VC TYPO3 Cross-Site Scripting in Language Pack Handling
Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting...
TYPO3 Information Disclosure in Install Tool
The Install Tool exposes the current TYPO3 version number to non-authenticated users...
GHSA-66C2-7G4P-WX4P TYPO3 Information Disclosure in Install Tool
The Install Tool exposes the current TYPO3 version number to non-authenticated users...
TYPO3 Security Misconfiguration in Install Tool Cookie
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...
GHSA-PPVG-HW62-6PH9 TYPO3 Security Misconfiguration in Install Tool Cookie
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...
PT-2024-40407 · Packagist · Typo3/Cms-Core
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A security issue has been found where cookies created in the Install Tool are not properly secured to only be submitted via HTTP. This, combined with other issues like cross-site...
PT-2024-40117 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue concerns the exposure of the current TYPO3 version number to non-authenticated users through the Install Tool. Recommendations: At the moment, there is no information about a newer...
PT-2024-40148 · Packagist · Typo3/Cms-Core
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue arises from the failure to properly encode information from external sources. Specifically, the language pack handling in the install tool is susceptible to cross-site...
BIT-TYPO3-2020-11069
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...
CVE-2024-22188
TYPO3 before 13.0.1 allows an authenticated admin user with system maintainer privileges to execute arbitrary shell commands with the privileges of the web server via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELT...
Command injection
TYPO3 before 13.0.1 allows an authenticated admin user with system maintainer privileges to execute arbitrary shell commands with the privileges of the web server via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELT...
TYPO3 Security Vulnerabilities
TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 versions prior to 13.0.1, which stems from a command injection vulnerability that can be exploited by authenticated administrator users to execute...
Code Injection
typo3/cms-core is vulnerable to Code Injection. The vulnerability is due to improper validation of settings within the Install Tool when configuring the path to system binaries. This vulnerability is only exploitable by an administrator-level backend user with system maintainer permissions...
Information Disclosure
TYPO3 is vulnerable to Information Disclosure. The vulnerability is due to the plaintext value of the $GLOBALS'SYS''encryptionKey' displayed in the TYPO3 Install Tool user interface. This allows an attacker to utilize the value to generate cryptographic hashes to verify the authenticity of HTTP...
CVE-2024-25119 Information Disclosure of Encryption Key in TYPO3 Install Tool
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS'SYS''encryptionKey' was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes...