CVE-2024-47780lowCWE-863

CVE-2024-47780: fallo de gravedad baja en typo3

Information Disclosure in TYPO3 Page Tree

Publicada el

Seguir esta CVE+ Monitorear typo3+ Monitorear typo3/cms-backend

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.1epss 0.3%
TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
TYPO3 · typo3
CVEs relacionadas — typo3

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-36104MEDIUMDenial of Service via Page Error Handling in TYPO3/cmsEPSS 1.6%CVE-2022-31050MEDIUMInsufficient Session Expiration in TYPO3 Admin ToolEPSS 1.3%CVE-2022-36105MEDIUMUser Enumeration via Response Timing in TYPO3EPSS 1.3%CVE-2021-41114MEDIUMHTTP Host Header Injection in Request Handling in Typo3EPSS 1.2%CVE-2022-31047MEDIUMInsertion of Sensitive Information into Log File in typo3/cms-coreEPSS 1.1%CVE-2023-38499LOWtypo3/cms-core Information Disclosure due to Out-of-scope Site ResolutionEPSS 1.1%