CVE-2024-34355

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.

• CWE-79
• CWE-116
• CWE-79

• https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375Patch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jcVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2024-007Vendor Advisory
• https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375Patch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jcVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2024-007Vendor Advisory

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3435A path traversal vulnerability exists in the 'save_settings'…8.4
• CVE-2024-34350Next.js is a React framework that can provide building block…7.5
• CVE-2024-34351Next.js is a React framework that can provide building block…7.5
• CVE-2024-343521Panel is an open source Linux server operation and maintena…7.5
• CVE-2024-34353The matrix-sdk-crypto crate, part of the Matrix Rust SDK pro…5.5
• CVE-2024-34354CMSaaSStarter is a SaaS template/boilerplate built with Svel…6.5
• CVE-2024-34356TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34357TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34358TYPO3 is an enterprise content management system. Starting i…5.3
• CVE-2024-34359llama-cpp-python is the Python bindings for llama.cpp. `llam…9.6
• CVE-2024-3436A vulnerability was found in SourceCodester Prison Managemen…7.2
• CVE-2024-34360go-spacemesh is a Go implementation of the Spacemesh protoco…8.2