Typo3 10.4
27 vulnérabilités ont été trouvés
1 paquets abandonnés ont été trouvés
Dernière analyse : il y a 6 jours
27 vulnérabilités ont été trouvés
| # | Total | C | H | M | L | |
|---|---|---|---|---|---|---|
| Composer | 27 | 0 | 5 | 15 | 7 | 0 |
Composer
16 typo3/cms-core —— v10.4.37 +
high TYPO3 Allows Privilege Escalation to System Maintainer
Versions affectées : >=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.4.0,<=10.4.49Versions patchées : 10.4.50 11.5.44 12.4.31 13.4.12
https://github.com/advisories/GHSA-6frx-j292-c844
high TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
Versions affectées : =13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56Versions patchées : 8.7.57 9.5.46 10.4.43 11.5.35 12.4.11 13.0.1
https://github.com/advisories/GHSA-rj3x-wvc6-5j66
high TYPO3 Install Tool vulnerable to Code Execution
Versions affectées : =13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56Versions patchées : 8.7.57 9.5.46 10.4.43 11.5.35 12.4.11 13.0.1
https://github.com/advisories/GHSA-5w2h-59j3-8x5w
medium TYPO3 Potential Open Redirect via Parsing Differences
Versions affectées : >=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47|>=9.0.0,<=9.5.48Versions patchées : 9.5.49 10.4.48 11.5.42 12.4.25 13.4.3
https://github.com/advisories/GHSA-2fx5-pggv-6jjr
medium TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController
Versions affectées : >=13.0.0,<=13.1.0|>=12.0.0,<=12.4.14|>=11.0.0,<=11.5.36|>=10.0.0,<=10.4.44|>=9.0.0,<=9.5.47Versions patchées : 9.5.48 10.4.45 11.5.37 12.4.15 13.1.1
https://github.com/advisories/GHSA-hw6c-6gwq-3m3m
medium TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
Versions affectées : >=13.0.0,<=13.1.0|>=12.0.0,<=12.4.14|>=11.0.0,<=11.5.36|>=10.0.0,<=10.4.44|>=9.0.0,<=9.5.47Versions patchées : 9.5.48 10.4.45 11.5.37 12.4.15 13.1.1
https://github.com/advisories/GHSA-v6mw-h7w6-59w3
medium TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key
Versions affectées : =13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56Versions patchées : 8.7.57 9.5.46 10.4.43 11.5.35 12.4.11 13.0.1
https://github.com/advisories/GHSA-h47m-3f78-qp9g
medium TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme
Versions affectées : =13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56Versions patchées : 8.7.57 9.5.46 10.4.43 11.5.35 12.4.11 13.0.1
https://github.com/advisories/GHSA-wf85-8hx9-gj7c
medium TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords
Versions affectées : =13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56Versions patchées : 8.7.57 9.5.46 10.4.43 11.5.35 12.4.11 13.0.1
https://github.com/advisories/GHSA-38r2-5695-334w
medium TYPO3-CORE-SA-2023-006: Weak Authentication in Session Handling
Versions affectées : >=8.0.0,<8.7.55|>=9.0.0,<9.5.44|>=10.0.0,<10.4.41|>=11.0.0,<11.5.33|>=12.0.0,<12.4.8Versions patchées : 8.7.55 9.5.44 10.4.41 11.5.33 12.4.8
https://typo3.org/security/advisory/typo3-core-sa-2023-006
medium TYPO3 Allows Unrestricted File Upload in File Abstraction Layer
Versions affectées : >=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50Versions patchées : 9.5.51 10.4.50 11.5.44 12.4.31 13.4.12
https://github.com/advisories/GHSA-9hq9-cr36-4wpj
medium TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController
Versions affectées : >=13.0.0,<=13.1.0|>=12.0.0,<=12.4.14|>=11.0.0,<=11.5.36|>=10.0.0,<=10.4.44|>=9.0.0,<=9.5.47Versions patchées : 9.5.48 10.4.45 11.5.37 12.4.15 13.1.1
https://github.com/advisories/GHSA-36g8-62qv-5957
medium Path Traversal in TYPO3 File Abstraction Layer Storages
Versions affectées : =13.0.0|>=12.0.0,<=12.4.10|>=11.0.0,<=11.5.34|>=10.0.0,<=10.4.42|>=9.0.0,<=9.5.45|>=8.0.0,<=8.7.56Versions patchées :
https://github.com/advisories/GHSA-w6x2-jg8h-p6mp
low TYPO3 Unverified Password Change for Backend Users
Versions affectées : >=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50Versions patchées : 9.5.51 9.5.51 10.4.50 11.5.44 12.4.31 13.4.12 10.4.50 11.5.44 12.4.31 13.4.12
https://github.com/advisories/GHSA-3jrg-97f3-rqh9
low Information Disclosure due to Out-of-scope Site Resolution
Versions affectées : >=12.0.0,<12.4.4|>=11.0.0,<11.5.30|>=10.0.0,<10.4.39|>=9.4.0,<9.5.42Versions patchées : 9.5.42 10.4.39 11.5.30 12.4.4
https://github.com/advisories/GHSA-jq6g-4v5m-wm9r
low TYPO3 Allows Information Disclosure via DBAL Restriction Handling
Versions affectées : >=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50Versions patchées : 9.5.51 10.4.50 11.5.44 12.4.31 13.4.12
https://github.com/advisories/GHSA-x8pv-fgxp-8v3x
1 typo3/cms-rte-ckeditor —— v10.4.37 +
medium Cross-Site Scripting in CKEditor4 WordCount Plugin
Versions affectées : >=11.0.0,<11.5.30|>=10.0.0,<10.4.39|>=9.5.0,<9.5.42Versions patchées : 9.5.42 10.4.39 11.5.30
https://github.com/advisories/GHSA-m8fw-p3cr-6jqc
2 typo3/cms-backend —— v10.4.37 +
low Information Disclosure in TYPO3 Page Tree
Versions affectées : <11.5.40|>=12.0.0,<12.4.21|>=13.0.0,<13.3.1Versions patchées : 13.3.1 12.4.21 11.5.40
https://github.com/advisories/GHSA-rf5m-h8q9-9w6q
low Denial of Service in TYPO3 Bookmark Toolbar
Versions affectées : >=10.0.0,<=10.4.45|>=11.0.0,<=11.5.39|>=12.0.0,<12.4.20|=13.0.0Versions patchées : 13.3.1 12.4.21 11.5.40 10.4.46
https://github.com/advisories/GHSA-ffcv-v6pw-qhrp
1 symfony/http-foundation —— v4.4.49 +
low CVE-2024-50345: Open redirect via browser-sanitized URLs
Versions affectées : >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7Versions patchées : 5.4.46 6.4.14 7.1.7 5.4.46 6.4.14 7.1.7
https://symfony.com/cve-2024-50345
1 symfony/process —— v4.4.44 +
high CVE-2024-51736: Command execution hijack on Windows with Process class
Versions affectées : >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7Versions patchées : 5.4.46 6.4.14 7.1.7 5.4.46 6.4.14 7.1.7
https://symfony.com/cve-2024-51736
1 typo3/cms-belog —— v10.4.37 +
medium TYPO3 Cross-Site Request Forgery in Log Module
Versions affectées : >=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47Versions patchées : 10.4.48 11.5.42 12.4.25 13.4.3
https://github.com/advisories/GHSA-cjfr-9f5r-3q93
1 typo3/cms-beuser —— v10.4.37 +
medium TYPO3 Cross-Site Request Forgery in Backend User Module
Versions affectées : >=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47Versions patchées : 10.4.48 11.5.42 12.4.25 13.4.3
https://github.com/advisories/GHSA-6w4x-gcx3-8p7v
1 typo3/cms-dashboard —— v10.4.37 +
medium TYPO3 Cross-Site Request Forgery in Dashboard Module
Versions affectées : >=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47Versions patchées : 10.4.48 11.5.42 12.4.25 13.4.3
https://github.com/advisories/GHSA-qwx7-39pw-2mhr
1 typo3/cms-extensionmanager —— v10.4.37 +
high TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery
Versions affectées : >=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47Versions patchées : 10.4.48 11.5.42 12.4.25 13.4.3
https://github.com/advisories/GHSA-4g52-pq8j-6qv5
1 typo3/cms-form —— v10.4.37 +
medium TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery
Versions affectées : >=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47Versions patchées : 10.4.48 11.5.42 12.4.25 13.4.3
https://github.com/advisories/GHSA-ww7h-g2qf-7xv6
1 typo3/cms-setup —— v10.4.37 +
low TYPO3 Unverified Password Change for Backend Users
Versions affectées : >=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30|>=11.0.0,<=11.5.43|>=10.0.0,<=10.4.49|>=9.0.0,<=9.5.50Versions patchées : 9.5.51 9.5.51 10.4.50 11.5.44 12.4.31 13.4.12 10.4.50 11.5.44 12.4.31 13.4.12
https://github.com/advisories/GHSA-3jrg-97f3-rqh9
1 paquets abandonnés ont été trouvés
| Paquet abandonné | Remplacement suggéré |
|---|---|
| symfony/inflector | EnglishInflector from the String component |
Share
[](https://audit.security.code-rhapsodie.fr/fr/project/018f871a-8eac-73fe-8c76-a61063f86748)
[](https://audit.security.code-rhapsodie.fr/fr/project/018f871a-8eac-73fe-8c76-a61063f86748)
[](https://audit.security.code-rhapsodie.fr/fr/project/018f871a-8eac-73fe-8c76-a61063f86748)
[](https://audit.security.code-rhapsodie.fr/fr/project/018f871a-8eac-73fe-8c76-a61063f86748)