CVE-2024-55892— Potential Open Redirect via Parsing Differences in TYPO3
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-55892
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Potential Open Redirect via Parsing Differences in TYPO3
Source: NVD (National Vulnerability Database)
Vulnerability Description
TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a query parameter) and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the validation checks. Users are advised to update to TYPO3 versions 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, 13.4.3 which fix the problem described. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: NVD (National Vulnerability Database)
Vulnerability Title
TYPO3 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TYPO3是瑞士TYPO3协会的一套免费开源的内容管理系统(框架)(CMS/CMF)。 TYPO3存在输入验证错误漏洞，该漏洞源于容易受到开放重定向或跨站请求伪造攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-55892
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-55892
请登录查看更多情报信息。
Same Patch Batch · TYPO3 · 2025-01-14 · 10 CVEs total
| CVE-2024-55924 | 8.0 HIGH | Cross-Site Request Forgery in Scheduler Module in TYPO3 |
| CVE-2024-55921 | 7.5 HIGH | Cross-Site Request Forgery in Extension Manager Module in TYPO3 |
| CVE-2024-55922 | 5.4 MEDIUM | Cross-Site Request Forgery in Form Framework Module in TYPO3 |
| CVE-2024-55923 | 4.3 MEDIUM | Cross-Site Request Forgery in Indexed Search Module in TYPO3 |
| CVE-2024-55894 | 4.3 MEDIUM | TYPO3 Cross-Site Request Forgery in Backend User Module |
| CVE-2024-55945 | 4.3 MEDIUM | Cross-Site Request Forgery in DB Check Module in TYPO3 |
| CVE-2024-55893 | 4.3 MEDIUM | TYPO3 Cross-Site Request Forgery in Log Module |
| CVE-2024-55920 | 4.3 MEDIUM | Cross-Site Request Forgery in Dashboard Module in TYPO3 |
| CVE-2024-55891 | 3.1 LOW | Information Disclosure via Exception Handling/Logger in TYPO3 |
IV. Related Vulnerabilities
Same product: typo3
- CVE-2025-47941
TYPO3 Has Broken Authentication in Backend MFA - CVE-2025-47940
TYPO3 CMS Vulnerable to Privilege Escalation to System Maint - CVE-2025-47939
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abs - CVE-2025-47938
TYPO3 Vulnerable to Unverified Password Change for Backend U - CVE-2025-47937
TYPO3 Vulnerable to Information Disclosure via DBAL Restrict
Same vendor: TYPO3
- CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module - CVE-2026-4208
Authentication Bypass in extension "E-Mail MFA Provider" (mf - CVE-2026-4202
Broken Access Control in extension "Redirect Tab" - CVE-2026-1323
Insecure Deserialization in extension "Mailqueue" (mailqueue - CVE-2026-0895
Insecure Deserialization in extension "Mailqueue" (mailqueue
Same weakness: CWE-601
- CVE-2026-42350
Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Qu - CVE-2026-42195
Unvalidated gitlab URL parameter redirects OAuth authorize s - CVE-2026-3318
Multiple vulnerabilities in Cradle e-commerce - CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incompl - CVE-2026-6795
Open Redirect in DivvyDrive Information Technologies' DivvyD
V. Comments for CVE-2024-55892
No comments yet