CMS: Typo3 developers seal ten security gaps
The content management system Typo3 closes ten security gaps with updated packages.
(Image: Shutterstock/Kaspars Grinvalds)
The developers have reported ten security vulnerabilities in the Typo3 content management system. Updated versions of Typo3 are available to patch the vulnerabilities, some of which are highly risky.
Most of the security leaks are of the cross-site scripting type. Attackers can use them to inject links into victims that inject malicious code into their user context and execute it. According to the description of the most serious vulnerability in the scheduler module, visiting a compromised or manipulated website is sufficient.
Videos by heise
Due to the severity of some vulnerabilities, IT managers should quickly install the updated software versions. The security-relevant errors correct the Typo3 versions 9.5.49 ELTS, 10.4.48 ELTS,11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS. They are available on the Typo3 download page. However, the updates for the 10 and 11 development branches in particular are no longer supported in the free version; users must switch to the 12 or 13 version. However, the security notices do not explain where those affected can obtain the update to Typo3 9.5.49 ELTS.
The vulnerabilities in detail:
- Cross-Site Request Forgery in Scheduler Module CVE-2024-55924, CVSS 8.0, high
- Cross-site request forgery in Extension Manager Module CVE-2024-55921, CVSS 7.5, high
- Cross-site request forgery in Form Framework Module CVE-2024-55922, CVSS 5.4, medium
- Potential Open Redirect via Parsing Differences CVE-2024-55892, CVSS 4.8, medium
- Cross-site request forgery in backend user module CVE-2024-55894, CVSS 4.3, medium
- Cross-site request forgery in dashboard module CVE-2024-55920, CVSS 4.3, medium
- Cross-site request forgery in DB Check Module CVE-2024-55945, CVSS 4.3, medium
- Cross-site request forgery in Indexed Search Module CVE-2024-55923, CVSS 4.3, medium
- Cross-site request forgery in Log Module CVE-2024-55893, CVSS 4.3, medium
- Information Disclosure via Exception Handling/Logger CVE-2024-55891, CVSS 3.1, low
High-risk vulnerabilities in Typo3 were last discovered in early 2023. Here, too, a cross-site scripting vulnerability allowed malicious HTML code to be injected.
(dmk)
