CVE-2024-34537: typo3 — Exploit & Fix

Description

TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1.

Is your site exposed to CVE-2024-34537?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
typo3	typo3	10.0.0 — 10.4.46
typo3	typo3	11.0.0 — 11.5.40
typo3	typo3	12.0.0 — 12.4.21
typo3	typo3	13.0.0 — 13.3.1

References

Advisories & Patches

https://github.com/TYPO3/typo3/security/advisories/GHSA-ffcv-v6pw-qhrp https://typo3.org/security/advisory/typo3-core-sa-2024-011

Exploits

https://www.mgm-sp.com/cve/denial-of-service-in-typo3-bookmark-toolbar

Frequently Asked Questions

What is CVE-2024-34537? +

TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1. It has a CVSS v3.1 base score of 4.9 (MEDIUM).

How severe is CVE-2024-34537? +

CVE-2024-34537 has a CVSS v3.1 score of 4.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-34537? +

CVE-2024-34537 affects products from typo3, specifically: typo3. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-34537? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-59017 8.8

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users …

CVE-2024-55924 8.0

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface …

CVE-2024-55921 7.5

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface …

CVE-2026-6553 7.5

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings …

CVE-2024-22188 7.2

TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges …

CVE-2025-47940 7.2

TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 …

CVE-2024-34537