CVE-2024-34356

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.

• CWE-79

• https://github.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156Patch
• https://github.com/TYPO3/typo3/commit/d0393a879a32fb4e3569acad6bdb5cda776be1e5Patch
• https://github.com/TYPO3/typo3/commit/e95a1224719efafb9cab2d85964f240fd0356e64Patch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-v6mw-h7w6-59w3Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2024-008Vendor Advisory
• https://github.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156Patch
• https://github.com/TYPO3/typo3/commit/d0393a879a32fb4e3569acad6bdb5cda776be1e5Patch
• https://github.com/TYPO3/typo3/commit/e95a1224719efafb9cab2d85964f240fd0356e64Patch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-v6mw-h7w6-59w3Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2024-008Vendor Advisory

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34350Next.js is a React framework that can provide building block…7.5
• CVE-2024-34351Next.js is a React framework that can provide building block…7.5
• CVE-2024-343521Panel is an open source Linux server operation and maintena…7.5
• CVE-2024-34353The matrix-sdk-crypto crate, part of the Matrix Rust SDK pro…5.5
• CVE-2024-34354CMSaaSStarter is a SaaS template/boilerplate built with Svel…6.5
• CVE-2024-34355TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34357TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34358TYPO3 is an enterprise content management system. Starting i…5.3
• CVE-2024-34359llama-cpp-python is the Python bindings for llama.cpp. `llam…9.6
• CVE-2024-3436A vulnerability was found in SourceCodester Prison Managemen…7.2
• CVE-2024-34360go-spacemesh is a Go implementation of the Spacemesh protoco…8.2
• CVE-2024-34361Pi-hole is a DNS sinkhole that protects devices from unwante…8.8