Read the docs
TI-2023-10314 Aliases CVE-2023-24814GHSA-r4f8-f93x-5qh3

Persisted Cross-Site Scripting in Frontend Rendering in typo3

Priority HIGH 71CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML code to pages that have not been rendered and cached, yet. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of `GeneralUtility::getIndpEnv('SCRIPT_NAME')` and corresponding usages (as shown below) are vulnerable as well. Additional investigations confirmed that at least Apache web server deployments using CGI (FPM, FCGI/FastCGI, and similar) are affected. However, there still might be the risk that other scenarios like nginx, IIS, or Apache/mod_php are vulnerable. The usage of server environment variable `PATH_INFO` has been removed from corresponding processings in `GeneralUtility::getIndpEnv()`. Besides that, the public property `TypoScriptFrontendController::$absRefPrefix` is encoded for both being used as a URI component and for being used as a prefix in an HTML context. This mitigates the cross-site scripting vulnerability. Users are advised to update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.35 LTS, 11.5.23 LTS and 12.2.0 which fix this problem. For users who are unable to patch in a timely manner the TypoScript setting `config.absRefPrefix` should at least be set to a static path value, instead of using auto - e.g. `config.absRefPrefix=/`. This workaround **does not fix all aspects of the vulnerability**, and is just considered to be an intermediate mitigation to the most prominent manifestation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00831 57th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed typo3 (TYPO3): 8.7.51, 9.5.40, 10.4.36 +1typo3/cms-core (Packagist): 12.2.0, 11.5.23, 10.4.36 +2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3typo38.7.0 to before 8.7.51; 9.0.0 to before 9.5.40; 10.0.0 to before 10.4.36; 11.0.0, < 11.5.23; 12.0.0 to before 12.2.08.7.51, 9.5.40, 10.4.36, 12.2.0Patch availableCNA
—typo3/cms-core (Packagist)12.0.0 to before 12.2.012.2.0Patch availableGHSA-r4f8-f93x-5qh3
—typo3/cms-core (Packagist)11.0.0 to before 11.5.2311.5.23Patch availableGHSA-r4f8-f93x-5qh3
—typo3/cms-core (Packagist)10.0.0 to before 10.4.3610.4.36Patch availableGHSA-r4f8-f93x-5qh3
—typo3/cms-core (Packagist)9.0.0 to before 9.5.409.5.40Patch availableGHSA-r4f8-f93x-5qh3
—typo3/cms-core (Packagist)8.7.0 to before 8.7.518.7.51Patch availableGHSA-r4f8-f93x-5qh3
—typo3/cms (Packagist)10.0.0 to before 10.4.3510.4.35Patch availableGHSA-r4f8-f93x-5qh3
—typo3/cms (Packagist)11.0.0 to before 11.5.2311.5.23Patch availableGHSA-r4f8-f93x-5qh3
—typo3/cms (Packagist)12.0.0 to before 12.2.012.2.0Patch availableGHSA-r4f8-f93x-5qh3
  • typo3 VendorTYPO3 Affected 8.7.0 to before 8.7.51; 9.0.0 to before 9.5.40; 10.0.0 to before 10.4.36; 11.0.0, < 11.5.23; 12.0.0 to before 12.2.0 Fixed in 8.7.51, 9.5.40, 10.4.36, 12.2.0 Patch available CNA
  • typo3/cms-core (Packagist) Vendor— Affected 12.0.0 to before 12.2.0 Fixed in 12.2.0 Patch available GHSA-r4f8-f93x-5qh3
  • typo3/cms-core (Packagist) Vendor— Affected 11.0.0 to before 11.5.23 Fixed in 11.5.23 Patch available GHSA-r4f8-f93x-5qh3
  • typo3/cms-core (Packagist) Vendor— Affected 10.0.0 to before 10.4.36 Fixed in 10.4.36 Patch available GHSA-r4f8-f93x-5qh3
  • typo3/cms-core (Packagist) Vendor— Affected 9.0.0 to before 9.5.40 Fixed in 9.5.40 Patch available GHSA-r4f8-f93x-5qh3
  • typo3/cms-core (Packagist) Vendor— Affected 8.7.0 to before 8.7.51 Fixed in 8.7.51 Patch available GHSA-r4f8-f93x-5qh3
  • typo3/cms (Packagist) Vendor— Affected 10.0.0 to before 10.4.35 Fixed in 10.4.35 Patch available GHSA-r4f8-f93x-5qh3
  • typo3/cms (Packagist) Vendor— Affected 11.0.0 to before 11.5.23 Fixed in 11.5.23 Patch available GHSA-r4f8-f93x-5qh3
  • typo3/cms (Packagist) Vendor— Affected 12.0.0 to before 12.2.0 Fixed in 12.2.0 Patch available GHSA-r4f8-f93x-5qh3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*8.7.0 to before 9.7.51; 9.0.0 to before 9.5.40; 10.0.0 to before 10.4.36; 11.0.0 to before 11.5.23; 12.0.0 to before 12.2.0VulnerableTYPO3
  • cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* Versions 8.7.0 to before 9.7.51; 9.0.0 to before 9.5.40; 10.0.0 to before 10.4.36; 11.0.0 to before 11.5.23; 12.0.0 to before 12.2.0 Vulnerable ·TYPO3

Remediation

  • Fix · CNA typo3 (TYPO3) Fixed in 8.7.51, 9.5.40, 10.4.36, 12.2.0
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms-core (Packagist) Fixed in 12.2.0 Advisory →
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms-core (Packagist) Fixed in 11.5.23 Advisory →
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms-core (Packagist) Fixed in 10.4.36 Advisory →
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms-core (Packagist) Fixed in 9.5.40 Advisory →
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms-core (Packagist) Fixed in 8.7.51 Advisory →
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms (Packagist) Fixed in 10.4.35 Advisory →
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms (Packagist) Fixed in 11.5.23 Advisory →
  • Fix · GHSA-r4f8-f93x-5qh3 typo3/cms (Packagist) Fixed in 12.2.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-24814
  2. 2026-10-03 Alias added: GHSA-r4f8-f93x-5qh3

References

Exploit 2

Patch 1

Advisory 2

Other 5

  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2009-00241 The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9… CVSS 2.0HIGH 10.0
  • TI-2020-08940 Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS CVSS 3.1CRITICAL 10.0
  • TI-2011-03994 Improper authentication in TYPO3 CVSS 3.1CRITICAL 9.8
  • TI-2011-03159 SQL injection in TYPO3 Core CVSS 3.1CRITICAL 9.8
See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences