typo3/cms

Packagist116 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting typo3/cmspage 1 of 3

CVE-2005-4875HIGHCVSS v2 7.5EG 7.5fixed in 3.8.1
2005-12-31
TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables.
CVE-2009-0256HIGHCVSS v2 7.5EG 7.5fixed in 4.0.10, 4.1.8 or 4.2.4, by version range
2009-01-22
Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) …
CVE-2009-0258HIGHCVSS v2 10.0EG 10.0fixed in 4.0.10, 4.1.8 or 4.2.4, by version range
2009-01-22
The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharac…
CVE-2009-0815MEDIUMCVSS v2 5.0EG 5.0fixed in 4.0.12, 4.1.10 or 4.2.6, by version range
2009-03-05
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitra…
CVE-2009-0816MEDIUMCVSS v2 4.3EG 4.3fixed in 4.0.12, 4.1.10 or 4.2.6, by version range
2009-03-05
vulnerable: 4.3alpha1
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or …
CVE-2009-3635MEDIUMCVSS v2 6.8EG 6.8fixed in 4.1.13, 4.2.10 or 4.3beta2, by version range
2009-11-02
The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.
CVE-2010-1153MEDIUMCVSS v2 6.8EG 6.8fixed in 4.3.3
2010-04-20
PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.
CVE-2010-3714HIGHCVSS v2 7.1EG 7.1fixed in 4.2.15, 4.3.7 or 4.4.4, by version range
2010-10-25
The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allo…
CVE-2010-5099MEDIUMCVSS v2 6.8EG 6.8fixed in 4.2.16, 4.3.9 or 4.4.5, by version range
2012-05-30
The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended acces…
CVE-2010-5101MEDIUMCVSS v2 4.0EG 4.0fixed in 4.2.16, 4.3.9 or 4.4.5, by version range
2012-05-21
Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "f…
CVE-2010-5103MEDIUMCVSS v2 6.0EG 6.0fixed in 4.2.16, 4.3.9 or 4.4.5, by version range
2012-05-21
SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-3583CRITICALCVSS 9.8EG 9.8
2019-11-26
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters a…
CVE-2011-4627MEDIUMCVSS 6.5EG 6.5fixed in 4.3.12, 4.4.9 or 4.5.4, by version range
2019-11-06
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.
CVE-2011-4628CRITICALCVSS 9.8EG 9.8fixed in 4.3.12, 4.4.9 or 4.5.4, by version range
2019-11-06
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.
CVE-2011-4630MEDIUMCVSS 5.4EG 5.4fixed in 4.5.4, 4.4.9 or 4.3.12, by version range
2019-11-06
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.
CVE-2011-4632MEDIUMCVSS 5.4EG 5.4fixed in 4.3.12, 4.4.9 or 4.5.4, by version range
2019-11-06
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.
CVE-2011-4900MEDIUMCVSS 6.5EG 6.5fixed in 4.5.4
2019-11-06
TYPO3 before 4.5.4 allows Information Disclosure in the backend.
CVE-2011-4901MEDIUMCVSS 6.5EG 6.5fixed in 4.3.12, 4.4.9 or 4.5.4, by version range
2019-11-06
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.
CVE-2011-4902MEDIUMCVSS 6.5EG 6.5fixed in 4.3.12, 4.4.9 or 4.5.4, by version range
2019-11-06
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.
CVE-2011-4903MEDIUMCVSS 6.1EG 6.1fixed in 4.3.12, 4.4.9 or 4.5.4, by version range
2019-11-06
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.
CVE-2011-4904MEDIUMCVSS 6.5EG 6.5fixed in 4.4.9 or 4.5.4, by version range
2019-11-06
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
CVE-2012-1605MEDIUMCVSS v2 5.0EG 5.0fixed in 4.6.7, 4.4.14 or 4.5.14, by version range
2012-09-04
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (H…
CVE-2012-1606LOWCVSS v2 3.5EG 3.5fixed in 4.4.14, 4.5.14 or 4.6.7, by version range
2012-09-04
Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or …
CVE-2012-1607MEDIUMCVSS v2 5.0EG 5.0
2012-09-04
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
CVE-2012-1608MEDIUMCVSS v2 5.0EG 5.0fixed in 4.4.14, 4.5.14 or 4.6.7, by version range
2012-09-04
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web scrip…
CVE-2012-2112MEDIUMCVSS v2 4.3EG 4.3fixed in 4.4.15, 4.5.15 or 4.6.8, by version range
2012-08-27
vulnerable: 4.7
Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.
CVE-2012-3527MEDIUMCVSS v2 4.6EG 4.6fixed in 4.5.19, 4.6.12 or 4.7.4, by version range
2012-09-05
view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an uns…
CVE-2012-3528LOWCVSS v2 3.5EG 3.5fixed in 4.5.19, 4.6.12 or 4.7.4, by version range
2012-09-05
Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vec…
CVE-2012-3529LOWCVSS v2 3.5EG 3.5fixed in 4.5.19, 4.6.12 or 4.7.4, by version range
2012-09-05
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.
CVE-2012-3530MEDIUMCVSS v2 4.3EG 4.3fixed in 4.5.19, 4.6.12 or 4.7.4, by version range
2012-09-05
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5…
CVE-2012-3531MEDIUMCVSS v2 4.3EG 4.3fixed in 4.5.19, 4.6.12 or 4.7.4, by version range
2012-09-05
Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-6144MEDIUMCVSS v2 6.5EG 6.5fixed in 4.5.21, 4.6.14 or 4.7.6, by version range
2013-07-01
SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-6145LOWCVSS v2 3.5EG 3.5fixed in 4.5.21, 4.6.14 or 4.7.6, by version range
2013-07-01
Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecifi…
CVE-2012-6146MEDIUMCVSS v2 4.0EG 4.0fixed in 4.5.21, 4.6.14 or 4.7.6, by version range
2014-05-20
The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.
CVE-2012-6147LOWCVSS v2 3.5EG 3.5fixed in 4.5.21, 4.6.14 or 4.7.6, by version range
2013-07-01
Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web scrip…
CVE-2012-6148LOWCVSS v2 3.5EG 3.5fixed in 4.5.21, 4.6.14 or 4.7.6, by version range
2013-07-01
Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified ve…
CVE-2013-4250MEDIUMCVSS v2 6.5EG 6.5fixed in 6.0.8 or 6.1.3, by version range
2014-05-20
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploadin…
CVE-2013-4321MEDIUMCVSS v2 6.5EG 6.5fixed in 6.0.9 or 6.1.4, by version range
2014-05-20
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulner…
CVE-2013-4701HIGHCVSS v2 7.5EG 7.5fixed in 6.2.6
2013-08-21
vulnerable: 6.2.0 ... 6.2.5 (6 versions)
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an exter…
CVE-2013-7073MEDIUMCVSS v2 4.0EG 4.0fixed in 4.5.32, 4.7.17, 6.0.12 or 6.1.7, by version range
2013-12-23
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table co…
CVE-2013-7074LOWCVSS v2 3.5EG 3.5fixed in 4.5.32, 4.7.17, 6.0.12 or 6.1.7, by version range
2013-12-21
Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users…
CVE-2013-7075MEDIUMCVSS v2 6.5EG 6.5fixed in 4.5.32, 4.7.17, 6.0.12 or 6.1.7, by version range
2013-12-23
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files…
CVE-2013-7341MEDIUMCVSS v2 4.3EG 4.3fixed in 6.2.14 or 7.3.1, by version range
2014-03-24
vulnerable: 7.0.0 ... 7.3.0 (6 versions)
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script …
CVE-2014-3941MEDIUMCVSS v2 5.0EG 5.0fixed in 4.5.34, 4.7.19, 6.0.14, 6.1.9 or 6.2.3, by version range
2014-06-03
vulnerable: 6.2.0, 6.2.1, 6.2.2
TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."
CVE-2014-3942MEDIUMCVSS v2 6.0EG 6.0fixed in 4.5.34, 4.7.19, 6.0.14 or 6.1.9, by version range
2014-06-03
The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.
CVE-2014-3943LOWCVSS v2 3.5EG 3.5fixed in 4.5.34, 4.7.19, 6.0.14, 6.1.9 or 6.2.3, by version range
2014-06-03
vulnerable: 6.2.0, 6.2.1, 6.2.2
Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to …
CVE-2014-3944MEDIUMCVSS v2 5.8EG 5.8fixed in 6.2.3
2014-06-03
vulnerable: 6.2.0, 6.2.1, 6.2.2
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
CVE-2014-3945MEDIUMCVSS v2 4.0EG 4.0fixed in 6.2.0
2014-06-03
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and…
CVE-2014-3946MEDIUMCVSS v2 4.0EG 4.0fixed in 6.2.3
2014-06-03
vulnerable: 6.2.0, 6.2.1, 6.2.2
The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.
CVE-2014-9508MEDIUMCVSS v2 4.3EG 4.3fixed in 4.5.39, 6.2.9 or 7.0.2, by version range
2015-01-04
vulnerable: 7.0.0, 7.0.1
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers…

Check whether typo3/cms is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for typo3/cms CVEs against the assets you own.

Book a Demo →