CVE-2024-34358
Description
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
How to fix
- typo3 typo39.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1 or later
- typo3/cms-core9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3 typo3 | 9.0.0 ≤ v < 9.5.48, 10.0.0 ≤ v < 10.4.45, 11.0.0 ≤ v < 11.5.37, 12.0.0 ≤ v < 12.4.15, 13.0.0 ≤ v < 13.1.1 | 9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1 |
| typo3/cms-corePackagist | 9.0.0 ≤ v < 9.5.48, 10.0.0 ≤ v < 10.4.45, 11.0.0 ≤ v < 11.5.37, 12.0.0 ≤ v < 12.4.15, 13.0.0 ≤ v < 13.1.1 | 9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.