dbcve.org
TYPO3CMS

CVE-2024-55924

HIGH · 8.0 CVSS v3.1 Published 2025-01-14
Fix available
A fix is available. Upgrade to 11.5.42 or later.
See remediation →
84/100
Remediation priority · High
Remotely reachable

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Scheduler Module” allows attackers to trigger pre-defined command classes - which can lead to unauthorized import or export of data in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS which fixes the problem described. There are no known workarounds for this vulnerability.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

CSRF vulnerability in TYPO3 backend deep link functionality allows attackers to trigger state-changing actions via HTTP GET requests in the Scheduler Module. The affected component does not enforce proper HTTP method restrictions, enabling unauthorized import or export of data through malicious URLs when victims have active backend sessions.

MitigationUpdate to TYPO3 version 11.5.42 ELTS. Review and ensure security.backend.enforceReferrer is enabled and BE/cookieSameSite is set to strict in configuration.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
TYPO3CMS
Affected:>= 11.0.0, < 11.5.42

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check installed TYPO3 version
    Locate the TYPO3 version number in the installation (composer.json file, or in the backend via Admin Tools > About > Installed Versions) and note the exact version.
    Affected if The installed version is greater than or equal to 11.0.0 and less than 11.5.42.
  2. Verify Scheduler Module availability
    Log into the TYPO3 backend and check if the Scheduler module is listed in the main navigation menu under Admin Tools or is otherwise accessible.
    Affected if The Scheduler module is installed and accessible to backend users.
  3. Inspect security.backend.enforceReferrer configuration
    Check the TYPO3 configuration file (usually LocalConfiguration.php or AdditionalConfiguration.php in typo3conf/) or access it via the Install Tool. Look for the setting $GLOBALS['TYPO3_CONF_VARS']['BE']['security']['backendEnforceReferrer'].
    Affected if The security.backend.enforceReferrer setting is not enabled (value is false or not set to 1).
  4. Inspect BE/cookieSameSite configuration
    Check the TYPO3 configuration for $GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] or equivalent. This can be found in LocalConfiguration.php or through the Install Tool configuration presets.
    Affected if The BE/cookieSameSite is not set to 'strict' (or is unset, or set to a less restrictive value).

You are affected if your TYPO3 version is between 11.0.0 and 11.5.42 (inclusive of the lower bound, exclusive of the upper), the Scheduler module is accessible, and either security.backend.enforceReferrer is disabled or cookieSameSite is not set to strict.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 11.5.42 or later
Fixed in 11.5.42
Interim mitigation

Update to TYPO3 version 11.5.42 ELTS. Review and ensure security.backend.enforceReferrer is enabled and BE/cookieSameSite is set to strict in configuration.

Recommended fix High confidence

TYPO3 11.5.42 ELTS

  1. 1. Backup your TYPO3 installation and database before proceeding with any upgrade.
  2. 2. Review the TYPO3 Upgrade Guide at https://docs.typo3.org/m/typo3/guide-installation/main/en-us/ for your current version path.
  3. 3. Update TYPO3 to version 11.5.42 (the ELTS release that contains the security fix).
  4. 4. After upgrading, verify that the `security.backend.enforceReferrer` feature is enabled (default behavior).
  5. 5. Confirm `BE/cookieSameSite` is set to 'strict' (recommended) rather than 'lax' or 'none' to prevent CSRF attacks.
  6. 6. Clear all caches after the upgrade using the Install Tool or CLI command: `typo3cms cache:flush`.
  7. 7. Test that the Scheduler Module functions correctly after the upgrade.
  8. 8. Verify backend user sessions work as expected with the new security settings.
Caveat Standard minor version upgrade within TYPO3 v11 branch - minimal breaking changes expected, but review extension compatibility and deprecation warnings in release notes

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in TYPO3 Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-55924 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-55924 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data