CVE-2023-38499

TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.

• CWE-200

• https://github.com/TYPO3/typo3/commit/702e2debd4b28f9cdb540544565fe6a8627ccb6aPatch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-jq6g-4v5m-wm9rVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2023-003Vendor Advisory
• https://github.com/TYPO3/typo3/commit/702e2debd4b28f9cdb540544565fe6a8627ccb6aPatch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-jq6g-4v5m-wm9rVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2023-003Vendor Advisory

Published

Jul 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38493Armeria is a microservice framework Spring supports Matrix v…7.5
• CVE-2023-38494MeterSphere is an open-source continuous testing platform. P…7.5
• CVE-2023-38495Crossplane is a framework for building cloud native control …9.8
• CVE-2023-38496Apptainer is an open source container platform. Version 1.2.…3.3
• CVE-2023-38497Cargo downloads the Rust project’s dependencies and compiles…7.3
• CVE-2023-38498Discourse is an open source discussion platform. Prior to ve…6.5
• CVE-2023-3850A vulnerability has been found in SourceCodester Lost and Fo…9.8
• CVE-2023-38500TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, a…6.1
• CVE-2023-38501copyparty is file server software. Prior to version 1.8.7, t…6.1
• CVE-2023-38502TDengine is an open source, time-series database optimized f…6.5
• CVE-2023-38503Directus is a real-time API and App dashboard for managing S…6.5
• CVE-2023-38504Sails is a realtime MVC Framework for Node.js. In Sails apps…7.5