NetSight
IP …
low3.1

CVE-2024-47780

Information Disclosure in TYPO3 Page Tree

Impact

### Problem Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. ### Solution Update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. ### Credits Thanks to Peter Schuler who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue.

Affected packages

EcosystemPackageAffectedFixed in
composertypo3/cms-backend>= 13.0.0, < 13.3.113.3.1

Affected products

VendorProductAffected versions
Typo3Typo3
from 10.0.0 before 10.4.46
from 11.0.0 before 11.5.40
from 12.0.0 before 12.4.21
from 13.0.0 before 13.3.1

Weakness classification

CWE-863

References