CVE-2024-25119
Information Disclosure of Encryption Key in TYPO3 Install Tool
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Information Disclosure of Encryption Key in TYPO3 Install Tool
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability.
- Record
CVE-2024-25119- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-0648
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-0648- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h47m-3f78-qp9g
TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key
Problem
The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.
Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
Credits
Thanks to TYPO3 core & security team member Benjamin Franzke who fixed the issue.
References
- Record
GHSA-h47m-3f78-qp9g- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability.
- Record
CVE-2024-25119- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Information Disclosure of Encryption Key in TYPO3 Install Tool
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability.
- Record
CVE-2024-25119- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-h47m-3f78-qp9g
TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key
Problem
The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.
Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
Credits
Thanks to TYPO3 core & security team member Benjamin Franzke who fixed the issue.
References
- Record
GHSA-h47m-3f78-qp9g- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist | 8.0.0 to 8.7.56 | 8.7.57 |
typo3/cms-corePackagist | 9.0.0 to 9.5.45 | 9.5.46 |
typo3/cms-corePackagist | 10.0.0 to 10.4.42 | 10.4.43 |
typo3/cms-corePackagist | 11.0.0 to 11.5.34 | 11.5.35 |
typo3/cms-corePackagist | 12.0.0 to 12.4.10 | 12.4.11 |
typo3/cms-corePackagist | 13.0.0 to 13.0.0 | 13.0.1 |
typo3/cms-corePackagist | 8.0.0 up to 8.7.57, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 21 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.30v8.7.31v8.7.32v8.7.7v8.7.8v8.7.9 | 8.7.57 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.46, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 36 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.17v9.5.18v9.5.19v9.5.2v9.5.20v9.5.21v9.5.22v9.5.23v9.5.24v9.5.25v9.5.26v9.5.27v9.5.28v9.5.29v9.5.3v9.5.30v9.5.31v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 | 9.5.46 |
typo3/cms-corePackagist | 10.0.0 up to 10.4.43, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 38 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.19v10.4.2v10.4.20v10.4.21v10.4.22v10.4.23v10.4.24v10.4.25v10.4.26v10.4.27v10.4.28v10.4.29v10.4.3v10.4.30v10.4.31v10.4.32v10.4.33v10.4.34v10.4.36v10.4.37v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 | 10.4.43 |
typo3/cms-corePackagist | 11.0.0 up to 11.5.35, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0 Show 39 moreShow lessv11.3.1v11.3.2v11.3.3v11.4.0v11.5.0v11.5.1v11.5.10v11.5.11v11.5.12v11.5.13v11.5.14v11.5.15v11.5.16v11.5.17v11.5.18v11.5.19v11.5.2v11.5.20v11.5.21v11.5.22v11.5.23v11.5.24v11.5.25v11.5.26v11.5.27v11.5.28v11.5.29v11.5.3v11.5.30v11.5.31v11.5.32v11.5.33v11.5.34v11.5.4v11.5.5v11.5.6v11.5.7v11.5.8v11.5.9 | 11.5.35 |
typo3/cms-corePackagist | 12.0.0 up to 12.4.11, plus listed versions v12.0.0v12.1.0v12.1.1v12.1.2v12.1.3 Show 13 moreShow lessv12.2.0v12.3.0v12.4.0v12.4.1v12.4.10v12.4.2v12.4.3v12.4.4v12.4.5v12.4.6v12.4.7v12.4.8v12.4.9 | 12.4.11 |
typo3/cms-corePackagist | 13.0.0 up to 13.0.1, plus listed versions v13.0.0 | 13.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25119 is a medium vulnerability (CVSS 4.9) in Typo3, published February 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in typo3/cms-core 8.7.57.
References
github.com/TYPO3/typo3/security/advisories/GHSA-h47m-3f78-qp9g
typo3.org/security/advisory/typo3-core-sa-2024-004
nvd.nist.gov/vuln/detail/CVE-2024-25119