CVE-2024-34355

Published May 14th, 2024

View on NVD ↗

CVSS v3

3.5

LOW

CVSS v2

N/A

Affected

PROJECT

Description

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

TYPO3/typo3

The TYPO3 Core - Enterprise Content Management System. Synchronized mirror of https://review.typo3.org/q/project:Packages/TYPO3.CMS

GitHub

1.19K