Skip to main content

Improper Access Control

CVE-2024-25120

Medium
4.3/10

Summary

TYPO3 is an open source PHP-based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. This issue affects the typo3 packages versions 8.0.0 through 8.7.56, 9.0.0 through 9.5.45, 10.0.0 through 10.4.42, 11.0.0 through 11.5.34, 12.0.0 through 12.4.10, and 13.0.0.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-284 - Improper Access Control

Listed 5th in the 'OWASP Top Ten', improper (or broken) access control attacks are a fundamental type of vulnerability. This includes a broad range of design flaws that enable users to act outside of their intended permissions. They can use these privileges to gain access to restricted files and functionality such as accessing restricted information, falsifying records, destroying data, or executing commands.

References

Advisory Timeline

  • Published