TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which fix the problem described. When persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected
    versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via
    `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve
    their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility
    layer for files located outside properly configured file storages and within the public web root
    directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to
    update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which
    fix the problem described. When persisting entities of the File Abstraction Layer directly via
    DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata`
    entities are not permitted to reference files in the fallback storage anymore. When importing data from
    secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using
    `$dataHandler->isImporting = true;`. (CVE-2024-25121)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1ad3d264-e36b-11ee-9c27-40b034429ecf advisory.

  - In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to     read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST     /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
    (CVE-2023-30451)

  - TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute     arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in     form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35     LTS, 12.4.11 LTS, and 13.0.1. (CVE-2024-22188)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password     hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed     attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability     requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46     ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known     workarounds for this issue. (CVE-2024-25118)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext     value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool     user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for     verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an     administrator-level backend user account with system maintainer permissions. Users are advised to update     to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the     problem described. There are no known workarounds for this vulnerability. (CVE-2024-25119)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. The     TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission     scope. This encompassed files, folders, pages, and records (although only if a valid link-handling     configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users     are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS,     13.0.1 that fix the problem described. There are no known workarounds for this issue. (CVE-2024-25120)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected     versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via     `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve     their file names and contents. The fallback storage (zero-storage) is used as a backward compatibility     layer for files located outside properly configured file storages and within the public web root     directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to     update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which     fix the problem described. When persisting entities of the File Abstraction Layer directly via     DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata`     entities are not permitted to reference files in the fallback storage anymore. When importing data from     secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using     `$dataHandler->isImporting = true;`. (CVE-2024-25121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of TYPO3 installed on the remote host is prior to 8.0.0 < 8.7.57 ELTS / 9.0.0 < 9.5.46 ELTS / 10.0.0 < 10.4.43 ELTS / 11.0.0 < 11.5.35 / 12.0.0 < 12.4.11 / 13.0.1. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2024-006 advisory.

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected     versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via     `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve     their file names and contents. The fallback storage (zero-storage) is used as a backward compatibility     layer for files located outside properly configured file storages and within the public web root     directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to     update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which     fix the problem described. When persisting entities of the File Abstraction Layer directly via     DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata`     entities are not permitted to reference files in the fallback storage anymore. When importing data from     secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using     `$dataHandler->isImporting = true;`. (CVE-2024-25121)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418768	SCA: security update for typo3/cms-core (GHSA-rj3x-wvc6-5j66)	Tenable Cloud Security	SCA Checks	high
418768	SCA: security update for typo3/cms-core (GHSA-rj3x-wvc6-5j66)	Tenable Self-Hosted Container Security	SCA Checks	high
192184	FreeBSD : typo3-{11,12} -- multiple vulnerabilities (1ad3d264-e36b-11ee-9c27-40b034429ecf)	Nessus	FreeBSD Local Security Checks	high
190452	TYPO3 8.0.0 < 8.7.57 ELTS / 9.0.0 < 9.5.46 ELTS / 10.0.0 < 10.4.43 ELTS / 11.0.0 < 11.5.35 / 12.0.0 < 12.4.11 / 13.0.1 (TYPO3-CORE-SA-2024-006)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-25121

high

Tenable Plugins

high

high

high

high