Every CVE Search/ Get API key

CVE-2024-55921

Cross-Site Request Forgery in Extension Manager Module in TYPO3

7.5 HighFix available

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.37%Up 0.3 points since Jan 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Cross-Site Request Forgery in Extension Manager Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.

Record
CVE-2024-55921
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-352, CWE-749
Updated
2026-11-02
EUVDEUVD-2025-0056 7.5

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.

Record
EUVD-2025-0056
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-4g52-pq8j-6qv5 7.5

TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery

Problem

A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method.

Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions:

  • the user opens a malicious link, such as one sent via email.
  • the user visits a compromised or manipulated website while the following settings are misconfigured:
    • security.backend.enforceReferrer feature is disabled,
    • BE/cookieSameSite configuration is set to lax or none

The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case.

Solution

Update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS that fix the problem described.

Credits

Thanks to TYPO3 core and security members Benjamin Franzke, Oliver Hader, Andreas Kienast, Torben Hansen, Elias Häußler who fixed the issue.

References

Record
GHSA-4g52-pq8j-6qv5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-352, CWE-749
Updated
2026-11-02
NVD 7.5

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.

Record
CVE-2024-55921
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-352, CWE-749
Updated
2026-11-02
OSV 7.5

Cross-Site Request Forgery in Extension Manager Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.

Record
CVE-2024-55921
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-352, CWE-749
Updated
2026-11-02
OSVGHSA-4g52-pq8j-6qv5 7.5

TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery

Problem

A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method.

Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions:

  • the user opens a malicious link, such as one sent via email.
  • the user visits a compromised or manipulated website while the following settings are misconfigured:
    • security.backend.enforceReferrer feature is disabled,
    • BE/cookieSameSite configuration is set to lax or none

The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case.

Solution

Update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS that fix the problem described.

Credits

Thanks to TYPO3 core and security members Benjamin Franzke, Oliver Hader, Andreas Kienast, Torben Hansen, Elias Häußler who fixed the issue.

References

Record
GHSA-4g52-pq8j-6qv5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-352, CWE-749
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
typo3/cms-extensionmanager
Packagist
 10.0.0 to 10.4.47
10.4.48
typo3/cms-extensionmanager
Packagist
 11.0.0 to 11.5.41
11.5.42
typo3/cms-extensionmanager
Packagist
 12.0.0 to 12.4.24
12.4.25
typo3/cms-extensionmanager
Packagist
 13.0.0 to 13.4.2
13.4.3
typo3/cms-extensionmanager
Packagist
 10.0.0 up to 10.4.48, plus listed versions
v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2
Show 38 moreShow less
v10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.19v10.4.2v10.4.20v10.4.21v10.4.22v10.4.23v10.4.24v10.4.25v10.4.26v10.4.27v10.4.28v10.4.29v10.4.3v10.4.30v10.4.31v10.4.32v10.4.33v10.4.34v10.4.36v10.4.37v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9
10.4.48
typo3/cms-extensionmanager
Packagist
 11.0.0 up to 11.5.42, plus listed versions
v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0
Show 45 moreShow less
v11.3.1v11.3.2v11.3.3v11.4.0v11.5.0v11.5.1v11.5.10v11.5.11v11.5.12v11.5.13v11.5.14v11.5.15v11.5.16v11.5.17v11.5.18v11.5.19v11.5.2v11.5.20v11.5.21v11.5.22v11.5.23v11.5.24v11.5.25v11.5.26v11.5.27v11.5.28v11.5.29v11.5.3v11.5.30v11.5.31v11.5.32v11.5.33v11.5.34v11.5.35v11.5.36v11.5.37v11.5.38v11.5.39v11.5.4v11.5.40v11.5.41v11.5.5v11.5.6v11.5.7v11.5.8
11.5.42
typo3/cms-extensionmanager
Packagist
 12.0.0 up to 12.4.25, plus listed versions
v12.0.0v12.1.0v12.1.1v12.1.2v12.1.3
Show 27 moreShow less
v12.2.0v12.3.0v12.4.0v12.4.1v12.4.10v12.4.11v12.4.12v12.4.13v12.4.14v12.4.15v12.4.16v12.4.17v12.4.18v12.4.19v12.4.2v12.4.20v12.4.21v12.4.22v12.4.23v12.4.24v12.4.3v12.4.4v12.4.5v12.4.6v12.4.7v12.4.8v12.4.9
12.4.25
typo3/cms-extensionmanager
Packagist
 13.0.0 up to 13.4.3, plus listed versions
v13.0.0v13.0.1v13.1.0v13.1.1v13.2.1
Show 5 moreShow less
v13.3.0v13.3.1v13.4.0v13.4.1v13.4.2
13.4.3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-55921 is a high vulnerability (CVSS 7.5) in Typo3, published January 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in typo3/cms-extensionmanager 10.4.48.

References

This page doesn't list everything

Left out here: 1 version. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open