Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2024-47780: TYPO3 backend shows restricted pages to users
CVE-2024-47780 · published 2 years ago
Summary
In the TYPO3 content system, some backend users can see pages they aren't allowed to access when page mounts are misconfigured or set to be public. They cannot edit these pages, but the visibility could expose internal site structure. Update to the latest TYPO3 versions listed to stop this behavior.
What to do
- Update typo3 cms-backend to version 13.3.1.
- Update typo3 cms-backend to version 12.4.21.
- Update typo3 cms-backend to version 11.5.40.
- Update typo3 cms-backend to version 10.4.46.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | typo3 | cms-backend |
>= 13.0.0, < 13.3.1 >= 12.0.0, < 12.4.21 >= 11.0.0, < 11.5.40 >= 10.0.0, < 10.4.46 Fix: upgrade to 13.3.1
|
| – | typo3 | typo3 |
>= 10.0.0, < 10.4.46 >= 11.0.0, < 11.5.40 >= 12.0.0, < 12.4.21 >= 13.0.0, < 13.3.1 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* |
Original advisory text
Information Disclosure in TYPO3 Page Tree
TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability.
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-rf5m-h8q9-9w6q Vendor Advisory
- https://github.com/TYPO3-CMS/backend/commit/8b024b08a2c7071a2f2ff7c758766e4e9273...
- https://github.com/TYPO3-CMS/backend/commit/9ae1ef969b63292a13f80955a95713cabd45...
- https://github.com/TYPO3-CMS/backend/commit/a7b3c924014ada61632cd5e3fb9825fcc86c...
- https://github.com/advisories/GHSA-rf5m-h8q9-9w6q
- https://nvd.nist.gov/vuln/detail/CVE-2024-47780 Vendor Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2024-012 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47780... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-863Incorrect Authorization
Timeline
Published8 Oct 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta