CVE-2024-47780 - CVE House
Back to Database
Status published Low CVE-2024-47780

Information Disclosure in TYPO3 Page Tree

Vulnerability Description

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47780

Credits & Attribution

No credits recorded in the NVD database.

References

More from TYPO3

View All →
CVE-2025-9573
Command Injection in extension "TYPO3 Backup Plus" (ns_backup)
High 8.6
CVE-2025-7900
Insecure Direct Object Reference in extension "femanager" (femanager)
Medium 5.3
CVE-2025-7899
Insecure Direct Object Reference in extension "powermail" (powermail)
Medium 6
CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
High 7.1
CVE-2025-59021
TYPO3 CMS Allows Broken Access Control in Redirects Module
Medium 5.3

Affected Vendor

Affected Software

typo3
Vulnerable Versions:
>= 10.0.0, < 10.4.46, >= 11.0.0, < 11.5.40, >= 12.0.0, < 12.4.21, >= 13.0.0, < 13.3.1

Timeline

Official Publish: October 8th, 2024
Last Modified: October 8th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion