Log in Start free

Vulnerability · Published Mar 5, 2024 · Assigned by mitre

CVE-2024-22188

High 7.2

In plain English

A high-severity code injection in the typo3/cms-core package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.0%top 19.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms-core8.7.57GHSA-5w2h-59j3-8x5w
Packagisttypo3/cms-core9.5.46GHSA-5w2h-59j3-8x5w
Packagisttypo3/cms-core10.4.43GHSA-5w2h-59j3-8x5w
Packagisttypo3/cms-core11.5.35GHSA-5w2h-59j3-8x5w
Packagisttypo3/cms-core12.4.11GHSA-5w2h-59j3-8x5w
Packagisttypo3/cms-core13.0.1GHSA-5w2h-59j3-8x5w

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References