MEDIUM5.4
GHSA-v6mw-h7w6-59w3
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
Quick fix
GHSA-v6mw-h7w6-59w3 — typo3/cms-core: upgrade to the fixed version with the command below.
composer require typo3/cms-core:^9.5.48Details
### Problem The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module.
### Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.
### Credits Thanks to TYPO3 core & security team member Benjamin Franzke who reported and fixed the issue.
### References * [TYPO3-CORE-SA-2024-008](https://typo3.org/security/advisory/typo3-core-sa-2024-008)
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/typo3/cms-core
Introduced in:
9.0.0Fixed in: 9.5.48Fix
composer require typo3/cms-core:^9.5.48Packagist/typo3/cms-core
Introduced in:
10.0.0Fixed in: 10.4.45Fix
composer require typo3/cms-core:^10.4.45Packagist/typo3/cms-core
Introduced in:
11.0.0Fixed in: 11.5.37Fix
composer require typo3/cms-core:^11.5.37Packagist/typo3/cms-core
Introduced in:
12.0.0Fixed in: 12.4.15Fix
composer require typo3/cms-core:^12.4.15Packagist/typo3/cms-core
Introduced in:
13.0.0Fixed in: 13.1.1Fix
composer require typo3/cms-core:^13.1.1References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-v6mw-h7w6-59w3[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-34356[ADVISORY]
- https://github.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156[WEB]
- https://github.com/TYPO3/typo3/commit/d0393a879a32fb4e3569acad6bdb5cda776be1e5[WEB]
- https://github.com/TYPO3/typo3/commit/e95a1224719efafb9cab2d85964f240fd0356e64[WEB]
- https://github.com/TYPO3/typo3[PACKAGE]
- https://typo3.org/security/advisory/typo3-core-sa-2024-008[WEB]