CVE-2024-34355

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-116

Affected software

Vendor	Product	Versions
TYPO3	typo3	>= 13.0.0, < 13.1.1

References

https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375Patch
https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jcVendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2024-007Vendor Advisory
https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375Patch
https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jcVendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2024-007Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-343565.4TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12 CVE-2024-343575.4TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12 CVE-2024-343585.3TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12 CVE-2024-343599.6llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp o CVE-2024-34367.2A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unkno CVE-2024-343608.2go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions (ATXs) which reference t CVE-2024-343618.8Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versio CVE-2024-343625.9Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServe CVE-2024-343637.5Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an CVE-2024-343646.5Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since asy CVE-2024-343659.1** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf CVE-2024-343665.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows