CVE-2024-34355
TYPO3 vulnerable to an HTML Injection in the History Module
概要
TYPO3 vulnerable to an HTML Injection in the History Module
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory typo3.org
- patch github.com