Detections
Analytics

SCA: security update for typo3/cms, typo3/cms-core (GHSA-r4f8-f93x-5qh3)

medium Tenable Cloud Security Plugin ID 418478

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - TYPO3 is a free and open source Content Management Framework released under the GNU General Public
 License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered
 server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In
 combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML
 code to pages that have not been rendered and cached, yet. As a result, injected values would be cached
 and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on
 the resolved value of `GeneralUtility::getIndpEnv('SCRIPT_NAME')` and corresponding usages (as shown
 below) are vulnerable as well. Additional investigations confirmed that at least Apache web server
 deployments using CGI (FPM, FCGI/FastCGI, and similar) are affected. However, there still might be the
 risk that other scenarios like nginx, IIS, or Apache/mod_php are vulnerable. The usage of server
 environment variable `PATH_INFO` has been removed from corresponding processings in
 `GeneralUtility::getIndpEnv()`. Besides that, the public property
 `TypoScriptFrontendController::$absRefPrefix` is encoded for both being used as a URI component and for
 being used as a prefix in an HTML context. This mitigates the cross-site scripting vulnerability. Users
 are advised to update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.35 LTS, 11.5.23 LTS and 12.2.0
 which fix this problem. For users who are unable to patch in a timely manner the TypoScript setting
 `config.absRefPrefix` should at least be set to a static path value, instead of using auto - e.g.
 `config.absRefPrefix=/`. This workaround **does not fix all aspects of the vulnerability**, and is just
 considered to be an intermediate mitigation to the most prominent manifestation. (CVE-2023-24814)

See Also

https://github.com/advisories/GHSA-r4f8-f93x-5qh3

Plugin Details

Severity: Medium

ID: 418478

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2023-24814

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/8/2023

Vulnerability Publication Date: 2/7/2023

Reference Information

CVE: CVE-2023-24814

cwe: CWE-79