CVE-2024-34355CWE-116CWE-79

TYPO3 vulnerable to an HTML Injection in the History Module

Low · published May 14, 2024

CVSS v3.1
3.5
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00586 · 47.3th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-14T14:01Z
EPSS history
Timeline
  • 14 MAY 14:01Z
    TYPO3 vulnerable to an HTML Injection in the History Module
    cvelistv5