DeutschShown in its original language — a full translation is planned for a future version.
TYPO3 Core: Mehrere Schwachstellen
view advisory published 2025-09-08
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen im TYPO3 Core ausnutzen, um Phishing-Angriffe durchzuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand zu verursachen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-59019US | medium4.3 | — | ||
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from a… | ||||
| CVE-2025-59018US | medium6.5 | — | ||
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to d… | ||||
| CVE-2025-59017US | high8.8OT elevated | — | ||
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to di… | ||||
| CVE-2025-59016US | medium4.3 | — | ||
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17… | ||||
| CVE-2025-59015US | medium6.5 | — | ||
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out… | ||||
| CVE-2025-59014US | low2.7 | — | ||
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑se… | ||||
| CVE-2025-59013US | medium6.1 | — | ||
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker… | ||||
02
references
External citations — patches, advisories, analysis.
- Typo3 Security Advisory vom 2025-09-08external
- Typo3 Security Advisory vom 2025-09-08external
- Typo3 Security Advisory vom 2025-09-08external
- Typo3 Security Advisory vom 2025-09-08external
- Typo3 Security Advisory vom 2025-09-08external
- Typo3 Security Advisory vom 2025-09-08external
- Typo3 Security Advisory vom 2025-09-08external
- Typo3 Security Advisory vom 2025-09-08external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan