GHSA-29m4-mx89-3mjg
TYPO3 Denial of Service in Online Media Asset Handling
Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
TYPO3 Denial of Service in Online Media Asset Handling
Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
- Record
GHSA-29m4-mx89-3mjg- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
TYPO3 Denial of Service in Online Media Asset Handling
Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
- Record
GHSA-29m4-mx89-3mjg- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist | 8.0.0 up to 8.7.21 | 8.7.21 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.2 | 9.5.2 |
typo3/cms-corePackagist | 7.0.0 up to 7.6.32 | 7.6.32 |
typo3/cms-corePackagist | 8.0.0 up to 8.7.21, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 9 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.7v8.7.8v8.7.9 | 8.7.21 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.2, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 6 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1 | 9.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-29m4-mx89-3mjg is a medium vulnerability (CVSS 5.3) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 8.7.21.
References
github.com/TYPO3-CMS/core/commit/9b2ecd2a402a76e17b78f78ed2ac9b7fff36d201
typo3.org/security/advisory/typo3-core-sa-2018-011