| Package | Affected versions | Patched versions |
|---|---|---|
| typo3/cms-core | ≥ 10.4.0, < 10.4.50≥ 11.0.0, < 11.5.44≥ 12.0.0, < 12.4.31≥ 13.0.0, < 13.4.12 | 10.4.5011.5.4412.4.3113.4.12 |
| typo3 | ≥ 10.4.0, < 10.4.50≥ 11.0.0, < 11.5.44≥ 12.0.0, < 12.4.31≥ 13.0.0, < 13.4.12 | 10.4.5011.5.4412.4.3113.4.12 |
Administrator-level backend users without system maintainer privileges can escalate their privileges and gain system maintainer access. Exploiting this vulnerability requires a valid administrator account.
Update to TYPO3 versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described.
Thanks to Alexander Künzl for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free