Detections
Analytics

SCA: security update for typo3/cms-core (GHSA-rj3x-wvc6-5j66)

high Tenable Self-Hosted Container Security Plugin ID 418768

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected
 versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via
 `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve
 their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility
 layer for files located outside properly configured file storages and within the public web root
 directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to
 update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which
 fix the problem described. When persisting entities of the File Abstraction Layer directly via
 DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata`
 entities are not permitted to reference files in the fallback storage anymore. When importing data from
 secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using
 `$dataHandler->isImporting = true;`. (CVE-2024-25121)

See Also

https://github.com/advisories/GHSA-rj3x-wvc6-5j66

Plugin Details

Severity: High

ID: 418768

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.91

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N

CVSS Score Source: CVE-2024-25121

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/13/2024

Vulnerability Publication Date: 2/13/2024

Reference Information

CVE: CVE-2024-25121