TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to
    versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP
    query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For
    instance, this allowed visitors to access content of an internal site by adding handcrafted query
    parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS,
    11.5.30, 12.4.4 fix the problem. (CVE-2023-38499)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b1ac663f-3aa9-11ee-b887-b42e991fc52e advisory.

  - ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the     `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to     the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin`     plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-37905)

  - TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to     versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP     query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For     instance, this allowed visitors to access content of an internal site by adding handcrafted query     parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS,     11.5.30, 12.4.4 fix the problem. (CVE-2023-38499)

  - TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe     markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to     versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in     a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but     might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of     TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem. (CVE-2023-38500)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of TYPO3 installed on the remote host is prior to 9.4.0 < 9.5.42 ELTS / 10.0.0 < 10.4.39 ELTS / 11.0.0 < 11.5.30 / 12.0.0 < 12.4.4. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2023-003 advisory.

  - In multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to     rendered content in the website frontend. For instance, this allowed visitors to access content of an     internal site by adding handcrafted query parameters to the URL of a site that was publicly available.
    (CVE-2023-38499)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416518	SCA: security update for typo3/cms-core (GHSA-jq6g-4v5m-wm9r)	Tenable Cloud Security	SCA Checks	medium
416518	SCA: security update for typo3/cms-core (GHSA-jq6g-4v5m-wm9r)	Tenable Self-Hosted Container Security	SCA Checks	medium
179872	FreeBSD : typo3 -- multiple vulnerabilities (b1ac663f-3aa9-11ee-b887-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	medium
178763	TYPO3 9.4.0 < 9.5.42 ELTS / 10.0.0 < 10.4.39 ELTS / 11.0.0 < 11.5.30 / 12.0.0 < 12.4.4 (TYPO3-CORE-SA-2023-003)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2023-38499

medium

Tenable Plugins

medium

medium

medium

medium