CVE-2024-34357 json
TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
published 2024-05-14 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1655 , GHSA-hw6c-6gwq-3m3m
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
Patch / fix
- packagist typo3/cms-core 9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
- typo3 typo3 9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
- github.com/TYPO3/typo3@3764749 commit
- github.com/TYPO3/typo3@b31d05d commit
- github.com/TYPO3/typo3@d774642 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=9.0.0, <9.5.48 >=10.0.0, <10.4.45 >=11.0.0, <11.5.37 >=12.0.0, <12.4.15 >=13.0.0, <13.1.1 |
9.5.48 10.4.45 11.5.37 12.4.15 13.1.1 |
Affected products
- TYPO3 typo3
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7
web, patch
-
github.com
/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee
web, patch
-
github.com
/TYPO3/typo3/commit/d774642381354d3bf5095a5a26e18acd2767f0b1
web, patch
-
github.com
/TYPO3/typo3/security/advisories/GHSA-hw6c-6gwq-3m3m
web, vendor-advisory
-
typo3.org
/security/advisory/typo3-core-sa-2024-009
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-34357
advisory
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2024-34357
- GitHub Advisory GHSA-hw6c-6gwq-3m3m
- NVD CVE-2024-34357
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.