Sign in
Deutsch English Español Polski
High

Backend Same-Site Request Forgery in TYPO3 CMS

  • Disclosed: 13.05.2020
  • Updated: 11.10.2026 10:22

Meta

  • CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
  • CWE-352
  • CWE-346

Problem

It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session.

In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it’s actually a same-origin request forgery.

Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location.

The attacked victim requires an active and valid backend or install tool user sessions at the time of the attack to be successful.

Solution

Update to TYPO3 versions 9.5.17 or 10.4.2 that mitigates the problem described.

Additional Considerations

The deployment of additional mitigation techniques is suggested as described below.

Sudo Mode Extension

This TYPO3 extension intercepts modifications to security relevant database tables, e.g. those storing user accounts or storages of the file abstraction layer. Modifications need to confirmed by again by the acting user with providing their password again - this technique is known as "sudo mode". This way unintended actions happening in the background can be mitigated.

Content Security Policy

Content Security Policies tell (modern) browsers how resources served a particular site are handled - it also it possible to disallow script executions for specific locations. In a TYPO3 context it is suggested to disallow direct script execution at least for locations /fileadmin/ and /uploads/.

# in fileadmin/.htaccess
<IfModule mod_headers.c>
	Header add Content-Security-Policy "default-src 'self'; script-src 'none';"
</IfModule>

Credits

Thanks to Matteo Bonaker who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

References

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package typo3/cms >= 10.0.0, < 10.4.2, >= 9.0.0, < 9.5.17 10.4.2, 9.5.17
Composer package typo3/cms-core >= 9.0.0, < 9.5.17, >= 10.0.0, < 10.4.2 9.5.17, 10.4.2

References

CVSS score 8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-346, CWE-352
Platform
Composer
Package
typo3/cms, typo3/cms-core
Disclosed
13.05.2020
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-pqg8-crx9-g8m4 - CC BY 4.0

Vulnerability history: typo3/cms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (188) in the archive
Total entries
188
First → latest
09.2018 06.2024
Without a fix
3
Exploited in attacks
0

Severity breakdown

  • Critical 6
  • High 41
  • Medium 128
  • Low 13

Disclosures per year

Severity:
  1. TYPO3 Security Misconfiguration in Install Tool Cookie
    High · 8.1 ghsa-f777-f784-36gm >= 7.0.0, < 7.6.32, >= 8.0.0, < 8.7.21, >= 9.0.0, < 9.5.2 7.6.32, 8.7.21, 9.5.2
  2. TYPO3 Arbitrary Code Execution via File List Module
    High · 8.8 ghsa-8h4m-r4wm-xj7r >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  3. TYPO3 Denial of Service in Frontend Record Registration
    High · 7.5 ghsa-g585-crjf-vhwq >= 7.0.0, < 7.6.32, >= 8.0.0, < 8.7.21 7.6.32, 8.7.21
  4. TYPO3 Security Misconfiguration for Backend User Accounts
    High · 7.3 ghsa-c5mj-39cf-3pp5 >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  5. TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling
    High · 8.1 ghsa-hh95-5xm5-v8v7 >= 8.0.0, < 8.7.30, >= 9.0.0, < 9.5.12 8.7.30, 9.5.12
  6. Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
    High ghsa-ppgf-8745-8pgx >= 7.0.0, < 7.6.30, >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2 7.6.30, 8.7.17, 9.3.2
  7. Privilege Escalation & SQL Injection in TYPO3 CMS
    High · 8.8 ghsa-7qwg-fcpw-xg5g >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.2 8.7.17, 9.3.2
  8. TYPO3 Remote Code Execution in third party library swiftmailer
    High ghsa-g4pf-3jvq-2gcw >= 6.2.0, < 6.2.30, >= 7.6.0, < 7.6.15, >= 8.0.0, < 8.5.1 6.2.30, 7.6.15, 8.5.1
  9. Arbitrary Code Execution in TYPO3 CMS
    Critical · 9.9 ghsa-67wg-6j7r-mqh8 >= 7.6.0, < 7.6.22, >= 8.0.0, < 8.7.5 7.6.22, 8.7.5
  10. Insecure Deserialization in TYPO3 CMS
    High ghsa-8h28-f46f-m87h >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.2 8.7.17, 9.3.2
  11. Missing Access Check in TYPO3 CMS
    Critical · 9.0 ghsa-gwfx-p7mr-f92v >= 6.2.0, < 6.2.25, >= 7.6.0, < 7.6.8, >= 8.0.0, < 8.1.1 6.2.25, 7.6.8, 8.1.1
  12. XML External Entity (XXE) Processing in TYPO3 Core
    High ghsa-qffc-gwpp-m2xr >= 6.2.0, < 6.2.19, >= 7.6.0, < 7.6.4 6.2.19, 7.6.4
  13. TYPO3 SQL Injection in dbal
    High ghsa-9895-53fc-98v2 >= 6.2.0, < 6.2.18 6.2.18
  14. TYPO3 frontend login vulnerable to Session Fixation
    High · 7.1 ghsa-r9vc-jfmh-6j48 >= 6.2.0, < 6.2.14, >= 7.0.0, < 7.3.1 6.2.14, 7.3.1
  15. TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
    High · 8.8 ghsa-4r76-xr68-w7m7 >= 6.2.0, < 6.2.14, >= 7.0.0, < 7.3.1 6.2.14, 7.3.1
  16. TYPO3 possible cache poisoning on the homepage when anchors are used
    High ghsa-p84g-j2gh-83g3 >= 6.2.0, < 6.2.9, >= 7.0.0, < 7.0.2 6.2.9, 7.0.2
  17. TYPO3 Arbitrary Shell Execution in Swiftmailer library
    High · 8.1 ghsa-45xg-4w5x-j429 >= 6.2.0, < 6.2.6, >= 6.1.0, < 6.1.12, >= 4.7.0, < 4.7.20, >= 4.5.0, < 4.5.37 6.2.6, 6.1.12, 4.7.20, 4.5.37
  18. TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
    High · 8.8 CVE-2023-24814 >= 10.0.0, < 10.4.35, >= 11.0.0, < 11.5.23, >= 12.0.0, < 12.2.0 10.4.35, 11.5.23, 12.2.0
  19. TYPO3 vulnerable to Insufficient Session Expiration
    Critical · 9.8 CVE-2022-47406 < 2.0.5, >= 3.0.0, < 3.0.3 2.0.5, 3.0.3
  20. TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
    High · 7.5 CVE-2022-23503 >= 10.0.0, < 10.4.33, >= 11.0.0, < 11.5.20, >= 12.0.0, < 12.1.1 10.4.33, 11.5.20, 12.1.1
  21. TYPO3 Vulnerable to Insecure Deserialization
    High · 8.8 CVE-2019-12747 >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  22. TYPO3 Image Processing susceptible to Code Execution
    High · 7.5 CVE-2019-11832 >= 8.0.0, < 8.7.25, >= 9.0.0, < 9.5.6 8.7.25, 9.5.6
  23. TYPO3 Insecure Deserialization in Query Generator & Query View
    High · 8.8 CVE-2019-19849 >= 10.0.0, < 10.2.1, >= 8.0.0, < 8.7.30, >= 9.0.0, < 9.5.12 10.2.1, 8.7.30, 9.5.12
  24. TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism
    High CVE-2010-3714 >= 4.2.0, < 4.2.15, >= 4.3.0, < 4.3.7, >= 4.4.0, < 4.4.4 4.2.15, 4.3.7, 4.4.4
  25. TYPO3 vulnerable to remote authenticated arbitrary code execution
    High CVE-2013-4321 >= 6.0.0, < 6.0.9, >= 6.1.0, < 6.1.4 6.0.9, 6.1.4
  26. TYPO3 doesn't properly check file extensions
    High CVE-2013-4250 >= 6.0.0, < 6.0.8, >= 6.1.0, < 6.1.3 6.0.8, 6.1.3
  27. TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
    Critical CVE-2014-3945 < 6.2.0 6.2.0
  28. Typo3 Vulnerable to Cache Poisoning
    High CVE-2014-9509 >= 4.5.0, < 4.5.39, >= 6.2.0, < 6.2.9, >= 7.0.0, < 7.0.2, >= 4.6.0, < 4.6.19, >= 4.7.0, < 4.7.21, >= 6.0.0, < 6.0.15, >= 6.1.0, < 6.1.13 4.5.39, 6.2.9, 7.0.2, 4.6.19, 4.7.21, 6.0.15, 6.1.13
  29. PHP OpenID Library Denial of Service vulnerability
    High CVE-2013-4701 >= 6.2.0, < 6.2.6 6.2.6
  30. TYPO3 Arbitrary Code Execution
    High · 8.8 CVE-2017-14251 >= 7.6.0, < 7.6.22, >= 8.0.0, < 8.7.5 7.6.22, 8.7.5
  31. TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code
    High CVE-2014-3942 >= 4.5.0, < 4.5.34, >= 4.7.0, < 4.7.19, >= 6.0.0, < 6.0.14, >= 6.1.0, < 6.1.9 4.5.34, 4.7.19, 6.0.14, 6.1.9
  32. TYPO3 PHP remote file inclusion vulnerability
    High CVE-2010-1153 >= 4.3.0, < 4.3.3 4.3.3
  33. Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
    High CVE-2009-0258 >= 4.0.0, < 4.0.10, >= 4.1.0, < 4.1.8, >= 4.2.0, < 4.2.4 4.0.10, 4.1.8, 4.2.4
  34. Authentication library in TYPO3 vulnerable to session fixation
    High CVE-2009-0256 >= 4.0.0, < 4.0.10, >= 4.1.0, < 4.1.8, >= 4.2.0, < 4.2.4 4.0.10, 4.1.8, 4.2.4
  35. TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`
    High CVE-2005-4875 < 3.8.1 3.8.1
  36. Typo3 SQL injection due to faulty prepared statements
    Critical · 9.8 CVE-2011-3583 >= 4.5.0, <= 4.5.5 no fix
  37. Typo3 Authentication Bypass
    Critical · 9.8 CVE-2011-4628 < 4.3.12, >= 4.4.0, < 4.4.9, >= 4.5.0, < 4.5.4 4.3.12, 4.4.9, 4.5.4
  38. Cross-Site-Request-Forgery in Backend
    High · 8.8 CVE-2021-41113 >= 11.2.0, < 11.5.0 11.5.0
  39. Broken Access Control in Form Framework
    High · 8.3 CVE-2021-21357 >= 10.0.0, < 10.4.14, >= 11.0.0, < 11.1.1, >= 9.0.0, < 9.5.25 10.4.14, 11.1.1, 9.5.25
  40. Unrestricted File Upload in Form Framework
    High · 8.6 CVE-2021-21355 >= 10.0.0, < 10.4.14, >= 11.0.0, < 11.1.1, >= 9.0.0, < 9.5.25 10.4.14, 11.1.1, 9.5.25
  41. Cleartext storage of session identifier
    High · 8.1 CVE-2020-26228 >= 10.0.0, < 10.4.10, >= 9.0.0, < 9.5.23, >= 8.7.0, < 8.7.38 10.4.10, 9.5.23, 8.7.38
  42. Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
    High · 8.1 CVE-2020-15099 >= 10.0.0, < 10.4.6, >= 9.0.0, < 9.5.20 10.4.6, 9.5.20
  43. Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
    High · 8.8 CVE-2020-15098 >= 10.0.0, < 10.4.6, >= 9.0.0, < 9.5.20 10.4.6, 9.5.20
  44. Backend Same-Site Request Forgery in TYPO3 CMS this entry
    High · 8.0 CVE-2020-11069 >= 10.0.0, < 10.4.2, >= 9.0.0, < 9.5.17 10.4.2, 9.5.17
  45. Insecure Deserialization in Backend User Settings in TYPO3 CMS
    High · 8.8 CVE-2020-11067 >= 10.0.0, < 10.4.2, >= 9.0.0, < 9.5.17 10.4.2, 9.5.17
  46. Class destructors causing side-effects when being unserialized in TYPO3 CMS
    High · 8.7 CVE-2020-11066 >= 10.0.0, < 10.4.2, >= 9.0.0, < 9.5.17 10.4.2, 9.5.17
  47. Deserialization of untrusted data in Symfony
    High · 7.1 CVE-2019-10912 >= 9.0.0, < 9.5.8 9.5.8

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.