CVE-2025-59017
EPSS 0.10%TYPO3 backend modules have Broken Access Control
發布日:2025/9/9修改日:2025/9/9
描述
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
受影響套件(5)
- Packagist/typo3/cms-backend>= 9.0.0, < 12.4.37
- Packagist/typo3/cms-beuser>= 13.0.0, < 13.4.18
- Packagist/typo3/cms-dashboard>= 10.0.0, < 12.4.37
- Packagist/typo3/cms-recycler>= 9.0.0, < 12.4.37
- Packagist/typo3/cms-workspaces>= 9.0.0, < 12.4.37
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-59017
- WEBhttps://github.com/TYPO3-CMS/backend/commit/0aedf33d910bceafc2ed0e715743cc0d30124501
- WEBhttps://github.com/TYPO3-CMS/beuser/commit/eb9b0c14a514a7aada8a2aa30e57696e286044c7
- WEBhttps://github.com/TYPO3-CMS/dashboard/commit/582006c6bdf251160001eee6624901baccdcfcd2
- WEBhttps://github.com/TYPO3-CMS/recycler/commit/43475578eb1d9fa3b765537c96bcdf48582ee53b
- WEBhttps://github.com/TYPO3-CMS/workspaces/commit/32222508043940f9073c338d4205c730a2e02070
- WEBhttps://typo3.org/security/advisory/typo3-core-sa-2025-021