Riskcovery

CVE-2024-34355

TYPO3 vulnerable to an HTML Injection in the History Module

State
Published
Severity
3.5 Low
Published
May 14, 2024
Updated
Aug 2, 2024
Reserved
May 2, 2024

Read the record on cve.org

Description

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NGitHub_M

Weaknesses

  • CWE-116 Improper Encoding or Escaping of Output
  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
typo3TYPO3
  • >= 13.0.0, < 13.1.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.