CVE-2024-34357

Katalog CVE

CVSS 5.4 · Medium EPSS 0,50%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada typo3. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

Rincian

Terbit di NVD

14 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m advisory vendor
• https://typo3.org/security/advisory/typo3-core-sa-2024-009 advisory vendor
• https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7 patch
• https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee patch
• https://github.com/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1 patch