How severe is CVE-2024-25120?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 4.3 out of 10.

What type of vulnerability is CVE-2024-25120?

This is classified as CWE-200, which is a common weakness in software security.

CVE-2024-25120 - MEDIUM Severity | CVSS 4.3

Vulnerability Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.

Related Vulnerabilities

CVE-2011-1934

MEDIUM

CVSS:4.3(Medium)

lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.

CWE-2002011

CVE-2012-1158

MEDIUM

CVSS:4.3(Medium)

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export

CWE-2002012

CVE-2012-1159

MEDIUM

CVSS:4.3(Medium)

Moodle before 2.2.2: Overview report allows users to see hidden courses

CWE-2002012

CVE-2012-1161

MEDIUM

CVSS:4.3(Medium)

Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results

CWE-2002012

CVE-2012-5570

MEDIUM

CVSS:4.3(Medium)

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.

CWE-2002012

CVE-2013-4317

MEDIUM

CVSS:4.3(Medium)

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their ...

CWE-2002013