CVE-2024-34355 - CVE House

Back to Database

Status published Low CVE-2024-34355

TYPO3 vulnerable to an HTML Injection in the History Module

3.5 CVSS

Vulnerability Description

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34355

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from TYPO3

View All →

Command Injection in extension "TYPO3 Backup Plus" (ns_backup)

Insecure Direct Object Reference in extension "femanager" (femanager)

Insecure Direct Object Reference in extension "powermail" (powermail)

TYPO3 CMS Allows Broken Access Control in Recycler Module

TYPO3 CMS Allows Broken Access Control in Redirects Module

Affected Vendor

TYPO3

View all reports →

Affected Software

typo3

Vulnerable Versions:

>= 13.0.0, < 13.1.1

Timeline

Official Publish: May 14th, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement