{"id":"CVE-2024-34358","aliases":["EUVD-2024-1379","GHSA-36g8-62qv-5957"],"status":"published","title":"TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController","description":"TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3\u0026...\u0026frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0047,"percentile":0.41104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-347","CWE-400","CWE-770"],"published":"2024-05-14T14:26:36Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"Packagist","package":"typo3/cms-core","fixed_in":["9.5.48","10.4.45","11.5.37","12.4.15","13.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"last_affected":"9.5.47"},{"fixed":"9.5.48"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.4.44"},{"fixed":"10.4.45"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.5.36"},{"fixed":"11.5.37"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.4.14"},{"fixed":"12.4.15"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"last_affected":"13.1.0"},{"fixed":"13.1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.48"}]}],"versions":["v9.0.0","v9.1.0","v9.2.0","v9.2.1","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.4.0","v9.5.0","v9.5.1","v9.5.10","v9.5.11","v9.5.12","v9.5.13","v9.5.14","v9.5.15","v9.5.16","v9.5.17","v9.5.18","v9.5.19","v9.5.2","v9.5.20","v9.5.21","v9.5.22","v9.5.23","v9.5.24","v9.5.25","v9.5.26","v9.5.27","v9.5.28","v9.5.29","v9.5.3","v9.5.30","v9.5.31","v9.5.4","v9.5.5","v9.5.6","v9.5.7","v9.5.8","v9.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.4.45"}]}],"versions":["v10.0.0","v10.1.0","v10.2.0","v10.2.1","v10.2.2","v10.3.0","v10.4.0","v10.4.1","v10.4.10","v10.4.11","v10.4.12","v10.4.13","v10.4.14","v10.4.15","v10.4.16","v10.4.17","v10.4.18","v10.4.19","v10.4.2","v10.4.20","v10.4.21","v10.4.22","v10.4.23","v10.4.24","v10.4.25","v10.4.26","v10.4.27","v10.4.28","v10.4.29","v10.4.3","v10.4.30","v10.4.31","v10.4.32","v10.4.33","v10.4.34","v10.4.36","v10.4.37","v10.4.4","v10.4.5","v10.4.6","v10.4.7","v10.4.8","v10.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.5.37"}]}],"versions":["v11.0.0","v11.1.0","v11.1.1","v11.2.0","v11.3.0","v11.3.1","v11.3.2","v11.3.3","v11.4.0","v11.5.0","v11.5.1","v11.5.10","v11.5.11","v11.5.12","v11.5.13","v11.5.14","v11.5.15","v11.5.16","v11.5.17","v11.5.18","v11.5.19","v11.5.2","v11.5.20","v11.5.21","v11.5.22","v11.5.23","v11.5.24","v11.5.25","v11.5.26","v11.5.27","v11.5.28","v11.5.29","v11.5.3","v11.5.30","v11.5.31","v11.5.32","v11.5.33","v11.5.34","v11.5.35","v11.5.36","v11.5.4","v11.5.5","v11.5.6","v11.5.7","v11.5.8","v11.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.4.15"}]}],"versions":["v12.0.0","v12.1.0","v12.1.1","v12.1.2","v12.1.3","v12.2.0","v12.3.0","v12.4.0","v12.4.1","v12.4.10","v12.4.11","v12.4.12","v12.4.13","v12.4.14","v12.4.2","v12.4.3","v12.4.4","v12.4.5","v12.4.6","v12.4.7","v12.4.8","v12.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.1.1"}]}],"versions":["v13.0.0","v13.0.1","v13.1.0"]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"https://github.com/TYPO3/typo3/security/advisories/GHSA-36g8-62qv-5957","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/TYPO3/typo3/commit/05c95fed869a1a6dcca06c7077b83b6ea866ff14","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/TYPO3/typo3/commit/1e70ebf736935413b0531004839362b4fb0755a5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/TYPO3/typo3/commit/df7909b6a1cf0f12a42994d0cc3376b607746142","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://typo3.org/security/advisory/typo3-core-sa-2024-010","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34358","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-36g8-62qv-5957"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34358.json","tags":["advisory"]},{"url":"https://github.com/TYPO3/typo3","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-34358","title":"TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController","description":"TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3\u0026...\u0026frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.","status":"published","published":"2024-05-14T14:26:36.422Z","modified":"2024-08-02T02:51:11.435Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-347","CWE-200"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-1379","description":"TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3\u0026...\u0026frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.","status":"published","published":"2024-05-14T14:26:36Z","modified":"2024-08-02T02:51:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:21.347751Z"}],"ghsa":[{"id":"GHSA-36g8-62qv-5957","title":"TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController","description":"### Problem\nThe `ShowImageController` (_eID tx_cms_showpic_) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3\u0026...\u0026frame=12345`).\nThis allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side.\n\n### Solution\nUpdate to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.\n\n#### ℹ️ **Strong security defaults - Manual actions required**\n\nThe `frame` HTTP query parameter is now ignored, since it could not be used by core APIs.\n\nThe new feature flag `security.frontend.allowInsecureFrameOptionInShowImageController` – which is disabled per default – can be used to reactivate the previous behavior.\n\n### Credits\nThanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core \u0026 security team members Benjamin Mack and Benjamin Franzke who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2024-010](https://typo3.org/security/advisory/typo3-core-sa-2024-010)\n","status":"published","published":"2024-05-14T20:13:34Z","modified":"2024-05-14T20:13:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-200","CWE-347","CWE-400"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2024-34358","description":"TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3\u0026...\u0026frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.","status":"published","published":"2024-05-14T16:17:25.69Z","modified":"2026-06-17T07:33:14.607Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-347","CWE-770"],"updated_at":"2026-11-02T14:09:58.124007Z"}],"osv":[{"id":"CVE-2024-34358","title":"TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController","description":"TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3\u0026...\u0026frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.","status":"published","published":"2024-05-14T14:26:36.422Z","modified":"2026-10-28T02:30:28.249042135Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-200","CWE-347"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-36g8-62qv-5957","title":"TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController","description":"### Problem\nThe `ShowImageController` (_eID tx_cms_showpic_) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3\u0026...\u0026frame=12345`).\nThis allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side.\n\n### Solution\nUpdate to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.\n\n#### ℹ️ **Strong security defaults - Manual actions required**\n\nThe `frame` HTTP query parameter is now ignored, since it could not be used by core APIs.\n\nThe new feature flag `security.frontend.allowInsecureFrameOptionInShowImageController` – which is disabled per default – can be used to reactivate the previous behavior.\n\n### Credits\nThanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core \u0026 security team members Benjamin Mack and Benjamin Franzke who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2024-010](https://typo3.org/security/advisory/typo3-core-sa-2024-010)\n","status":"published","published":"2024-05-14T20:13:34Z","modified":"2026-09-10T03:50:12.924741922Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-200","CWE-347","CWE-400"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}