CVE-2024-47780

LOW

3.1

Description

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability.

CVE Details

CVSS v3.1 Score3.1

SeverityLOW

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredLOW

User InteractionNONE

Published10/8/2024

Last Modified9/3/2025

Sourcenvd

Honeypot Sightings0

Affected Products

typo3:typo3

Weaknesses (CWE)

CWE-863

References

https://github.com/TYPO3/typo3/security/advisories/GHSA-rf5m-h8q9-9w6q(security-advisories@github.com)

https://typo3.org/security/advisory/typo3-core-sa-2024-012(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.