CVE-2024-22188

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-221897.5quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sendin CVE-2024-221907.8GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython u CVE-2024-221915.4Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_val CVE-2024-221926.5Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a CVE-2024-221934.3The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation CVE-2024-221942.8cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic CVE-2024-221956.1Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible t CVE-2024-221966.5Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This is CVE-2024-221978.8Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home CVE-2024-221988.8Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration set CVE-2024-221996.1This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulner CVE-2024-22203.5The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users