Description

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

Remediation

References

CVE-2024-34357

Related Vulnerabilities

phpList Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-35708)

WordPress Plugin UpdraftPlus WordPress Backup Cross-Site Scripting (1.22.8)

WordPress Plugin eCommerce Product Catalog for WordPress Cross-Site Request Forgery (3.0.17)

WordPress Plugin White Label CMS Cross-Site Scripting (1.5.2)

WordPress Plugin GiveWP-Donation and Fundraising Platform Cross-Site Scripting (2.10.3)

Severity

Medium

Classification

CVE-2024-34357 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities