24 matches found
CVE-2026-112237 Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...
CVE-2026-112237 Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...
CVE-2026-112237
The Kitodo.Presentation extension (dlf) is vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from a public proxy endpoint that fails to apply authorization checks for one specific HTTP request method. This allows an unauthenticated attacker to force the server to send requests ...
TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032...
TYPO3 Kitodo.Presentation: Server-side request forgeing vulnerability
Versions of TYPO3 prior to 6.0.1 and from 7.0.0 to 7.0.2 contain a server-side request forgeing vulnerability. This vulnerability stems from an HTTP request method that fails to perform authorization checks. As a result, the requester has full control over the accessed URL. Unauthenticated...
EUVD-2022-1250
Malicious code in bioql PyPI...
CVE-2022-24980
An issue was discovered in the Kitodo.Presentation aka dif extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
GHSA-X832-R2RJ-4G5P SSRF in Kitodo.Presentation
An issue was discovered in the Kitodo.Presentation aka dlf extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
SSRF in Kitodo.Presentation
An issue was discovered in the Kitodo.Presentation aka dlf extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
CVE-2022-24980
An issue was discovered in the Kitodo.Presentation aka dif extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
Design/Logic Flaw
An issue was discovered in the Kitodo.Presentation aka dif extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
CVE-2022-24980
An issue was discovered in the Kitodo.Presentation aka dif extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
CVE-2022-24980
The CVE-2022-24980 issue affects Kitodo.Presentation (dlf) in TYPO3 before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4, where a missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs. This enables server-side request forgery (SSRF), letting an attacker v...
CVE-2022-24980
An issue was discovered in the Kitodo.Presentation aka dif extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
CVE-2022-24980: Server-Side Request Forgery (SSRF)
An issue was discovered in the Kitodo.Presentation aka dif extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...
PT-2022-17027
Name of the Vulnerable Software and Affected Versions Kitodo.Presentation extension versions prior to 2.3.2 Kitodo.Presentation extension versions 3.x prior to 3.2.3 Kitodo.Presentation extension versions 3.3.x prior to 3.3.4 Description A missing access check in an eID script allows an...
Server-side request forgery in extension "Kitodo.Presentation" (dlf)
A missing access check in an eID script of the extension allows an unauthenticated user to submit arbitrary URLs to this component. This results in Server-side request forgery allowing users to view the content of any file or webpage the webserver has access to...
GHSA-FPQV-X9HM-35J9 Cross-site Scripting vulnerability in Kitodo.Presentation
Impact Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting XSS. Only sites using the ListView, Navigation or PageView plugins are affected. It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site...
Cross-site Scripting vulnerability in Kitodo.Presentation
Impact Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting XSS. Only sites using the ListView, Navigation or PageView plugins are affected. It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site...