CVE-2024-25120 json
Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
published 2024-02-13 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-0750 , GHSA-wf85-8hx9-gj7c
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
Patch / fix
- packagist typo3/cms-core 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
- typo3 typo3 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
- github.com/TYPO3/typo3@2de87ff commit
- github.com/TYPO3/typo3@33f4d27 commit
- github.com/TYPO3/typo3@ae0dfc4 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=8.0.0, <8.7.57 >=9.0.0, <9.5.46 >=10.0.0, <10.4.43 >=11.0.0, <11.5.35 >=12.0.0, <12.4.11 >=13.0.0, <13.0.1 |
8.7.57 9.5.46 10.4.43 11.5.35 12.4.11 13.0.1 |
Affected products
- TYPO3 typo3
Classification
References
-
github.com
/TYPO3/typo3/commit/2de87ff113ba24333ab7cbb8078588743f8958d6
web
-
github.com
/TYPO3/typo3/commit/33f4d279b82bca0a509227a17065244c6156e68f
web
-
github.com
/TYPO3/typo3/commit/ae0dfc4c058a90c10eedb3f49cfaf33164d21cdd
web
-
typo3.org
/security/advisory/typo3-core-sa-2024-005
web, vendor-advisory
-
github.com
/TYPO3/typo3/security/advisories/GHSA-wf85-8hx9-gj7c
web, third-party-advisory
-
docs.typo3.org
/m/typo3/reference-typoscript/main/en-us/Functions/Typolink.html#resource-references
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-25120
advisory
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2024-25120
- GitHub Advisory GHSA-wf85-8hx9-gj7c
- NVD CVE-2024-25120
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.