TYPO3 Bookmark Toolbar vulnerable to denial of service
The advisory, in context
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 11.0.0 before 12.4.37
Fixed in 12.4.37
95 explicitly affected versions
v11.0.0, v11.1.0, v11.1.1, v11.2.0, v11.3.0, v11.3.1, v11.3.2, v11.3.3, v11.4.0, v11.5.0, v11.5.1, v11.5.10, v11.5.11, v11.5.12, v11.5.13, v11.5.14, v11.5.15, v11.5.16, v11.5.17, v11.5.18, v11.5.19, v11.5.2, v11.5.20, v11.5.21, v11.5.22, v11.5.23, v11.5.24, v11.5.25, v11.5.26, v11.5.27, v11.5.28, v11.5.29, v11.5.3, v11.5.30, v11.5.31, v11.5.32, v11.5.33, v11.5.34, v11.5.35, v11.5.36, v11.5.37, v11.5.38, v11.5.39, v11.5.4, v11.5.40, v11.5.41, v11.5.5, v11.5.6, v11.5.7, v11.5.8, v11.5.9, v12.0.0, v12.1.0, v12.1.1, v12.1.2, v12.1.3, v12.2.0, v12.3.0, v12.4.0, v12.4.1, v12.4.10, v12.4.11, v12.4.12, v12.4.13, v12.4.14, v12.4.15, v12.4.16, v12.4.17, v12.4.18, v12.4.19, v12.4.2, v12.4.20, v12.4.21, v12.4.22, v12.4.23, v12.4.24, v12.4.25, v12.4.26, v12.4.27, v12.4.28, v12.4.29, v12.4.3, v12.4.30, v12.4.31, v12.4.32, v12.4.33, v12.4.34, v12.4.35, v12.4.36, v12.4.4, v12.4.5, v12.4.6, v12.4.7, v12.4.8, v12.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "12.4.37"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v11.0.0",
"v11.1.0",
"v11.1.1",
"v11.2.0",
"v11.3.0",
"v11.3.1",
"v11.3.2",
"v11.3.3",
"v11.4.0",
"v11.5.0",
"v11.5.1",
"v11.5.10",
"v11.5.11",
"v11.5.12",
"v11.5.13",
"v11.5.14",
"v11.5.15",
"v11.5.16",
"v11.5.17",
"v11.5.18",
"v11.5.19",
"v11.5.2",
"v11.5.20",
"v11.5.21",
"v11.5.22",
"v11.5.23",
"v11.5.24",
"v11.5.25",
"v11.5.26",
"v11.5.27",
"v11.5.28",
"v11.5.29",
"v11.5.3",
"v11.5.30",
"v11.5.31",
"v11.5.32",
"v11.5.33",
"v11.5.34",
"v11.5.35",
"v11.5.36",
"v11.5.37",
"v11.5.38",
"v11.5.39",
"v11.5.4",
"v11.5.40",
"v11.5.41",
"v11.5.5",
"v11.5.6",
"v11.5.7",
"v11.5.8",
"v11.5.9",
"v12.0.0",
"v12.1.0",
"v12.1.1",
"v12.1.2",
"v12.1.3",
"v12.2.0",
"v12.3.0",
"v12.4.0",
"v12.4.1",
"v12.4.10",
"v12.4.11",
"v12.4.12",
"v12.4.13",
"v12.4.14",
"v12.4.15",
"v12.4.16",
"v12.4.17",
"v12.4.18",
"v12.4.19",
"v12.4.2",
"v12.4.20",
"v12.4.21",
"v12.4.22",
"v12.4.23",
"v12.4.24",
"v12.4.25",
"v12.4.26",
"v12.4.27",
"v12.4.28",
"v12.4.29",
"v12.4.3",
"v12.4.30",
"v12.4.31",
"v12.4.32",
"v12.4.33",
"v12.4.34",
"v12.4.35",
"v12.4.36",
"v12.4.4",
"v12.4.5",
"v12.4.6",
"v12.4.7",
"v12.4.8",
"v12.4.9"
]
}From 12.0.0 before 12.4.37
Fixed in 12.4.37
44 explicitly affected versions
v12.0.0, v12.1.0, v12.1.1, v12.1.2, v12.1.3, v12.2.0, v12.3.0, v12.4.0, v12.4.1, v12.4.10, v12.4.11, v12.4.12, v12.4.13, v12.4.14, v12.4.15, v12.4.16, v12.4.17, v12.4.18, v12.4.19, v12.4.2, v12.4.20, v12.4.21, v12.4.22, v12.4.23, v12.4.24, v12.4.25, v12.4.26, v12.4.27, v12.4.28, v12.4.29, v12.4.3, v12.4.30, v12.4.31, v12.4.32, v12.4.33, v12.4.34, v12.4.35, v12.4.36, v12.4.4, v12.4.5, v12.4.6, v12.4.7, v12.4.8, v12.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.4.37"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v12.0.0",
"v12.1.0",
"v12.1.1",
"v12.1.2",
"v12.1.3",
"v12.2.0",
"v12.3.0",
"v12.4.0",
"v12.4.1",
"v12.4.10",
"v12.4.11",
"v12.4.12",
"v12.4.13",
"v12.4.14",
"v12.4.15",
"v12.4.16",
"v12.4.17",
"v12.4.18",
"v12.4.19",
"v12.4.2",
"v12.4.20",
"v12.4.21",
"v12.4.22",
"v12.4.23",
"v12.4.24",
"v12.4.25",
"v12.4.26",
"v12.4.27",
"v12.4.28",
"v12.4.29",
"v12.4.3",
"v12.4.30",
"v12.4.31",
"v12.4.32",
"v12.4.33",
"v12.4.34",
"v12.4.35",
"v12.4.36",
"v12.4.4",
"v12.4.5",
"v12.4.6",
"v12.4.7",
"v12.4.8",
"v12.4.9"
]
}From 13.0.0 before 13.4.18
Fixed in 13.4.18
25 explicitly affected versions
v13.0.0, v13.0.1, v13.1.0, v13.1.1, v13.2.1, v13.3.0, v13.3.1, v13.4.0, v13.4.1, v13.4.10, v13.4.11, v13.4.12, v13.4.13, v13.4.14, v13.4.15, v13.4.16, v13.4.17, v13.4.2, v13.4.3, v13.4.4, v13.4.5, v13.4.6, v13.4.7, v13.4.8, v13.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.4.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v13.0.0",
"v13.0.1",
"v13.1.0",
"v13.1.1",
"v13.2.1",
"v13.3.0",
"v13.3.1",
"v13.4.0",
"v13.4.1",
"v13.4.10",
"v13.4.11",
"v13.4.12",
"v13.4.13",
"v13.4.14",
"v13.4.15",
"v13.4.16",
"v13.4.17",
"v13.4.2",
"v13.4.3",
"v13.4.4",
"v13.4.5",
"v13.4.6",
"v13.4.7",
"v13.4.8",
"v13.4.9"
]
}