{"action":"Upgrade typo3/cms-core to 8.7.51 or later.","affected":[{"fixed":"12.2.0","introduced":"12.0.0"},{"fixed":"11.5.23","introduced":"11.0.0"},{"fixed":"10.4.36","introduced":"10.0.0"},{"fixed":"9.5.40","introduced":"9.0.0"},{"fixed":"8.7.51","introduced":"8.7.0"}],"component":"typo3/cms-core","cve_ids":["CVE-2023-24814"],"ecosystem":"Packagist","epss":0.00831,"exploited":false,"fixed_versions":["12.2.0","11.5.23","10.4.36","9.5.40","8.7.51"],"ghsa_id":"GHSA-r4f8-f93x-5qh3","id":"tcs_01M5KF7W2D9VA2WZ1FFT2GYS64","modified_at":"2026-09-10T03:49:52.186326016Z","published_at":"2023-02-08T21:33:24Z","references":["https://osv.dev/vulnerability/GHSA-r4f8-f93x-5qh3","https://github.com/TYPO3/typo3/security/advisories/GHSA-r4f8-f93x-5qh3","https://nvd.nist.gov/vuln/detail/CVE-2023-24814","https://github.com/TYPO3/typo3/commit/0005a6fd86ab97eff8bf2e3a5828bf0e7cb6263a","https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Setup/Config/Index.html#absrefprefix","https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2023-24814.yaml","https://github.com/TYPO3/typo3","https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/core/Classes/Utility/GeneralUtility.php#L2481-L2484","https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php#L2547-L2549","https://typo3.org/security/advisory/typo3-core-sa-2023-001","https://typo3.org/security/advisory/typo3-psa-2023-001"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-r4f8-f93x-5qh3","url":"https://osv.dev/vulnerability/GHSA-r4f8-f93x-5qh3"}],"summary":"TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering"}