UpHeron
All vulnerabilities

Servers and applications

CVE-2023-24814

Persisted Cross-Site Scripting in Frontend Rendering

Severity
Medium 6.1
Published
7 Feb 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.5.40, 9.7.51, 10.4.36, 11.5.23, 12.2.0
Also known as
GHSA-r4f8-f93x-5qh3
Sources
NVD, Project advisories (GitHub)

Description

TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject…

Affected software

SoftwareAffected versions
TYPO3Servers and applications · cpe:a:typo3:typo3
  • From 8.7.0 before 9.7.51
  • From 9.0.0 before 9.5.40
  • From 10.0.0 before 10.4.36
  • From 11.0.0 before 11.5.23
  • From 12.0.0 before 12.2.0
TYPO3Servers and applications · github:typo3/typo3
  • From 12.0.0 before 12.2.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-24814
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-24814
  • GitHub Advisory Database https://github.com/advisories/GHSA-r4f8-f93x-5qh3
  • github.com https://github.com/TYPO3/typo3/security/advisories/GHSA-r4f8-f93x-5qh3