{"action":"Upgrade typo3/cms to 10.4.35 or later.","affected":[{"fixed":"10.4.35","introduced":"10.0.0"},{"fixed":"11.5.23","introduced":"11.0.0"},{"fixed":"12.2.0","introduced":"12.0.0"}],"component":"typo3/cms","cve_ids":["CVE-2023-24814"],"ecosystem":"Packagist","epss":0.00831,"exploited":false,"fixed_versions":["10.4.35","11.5.23","12.2.0"],"ghsa_id":"GHSA-r4f8-f93x-5qh3","id":"tcs_01M5KF7W4CQ459QDXDXWJ9WHBH","modified_at":"2026-09-10T03:49:52.186326016Z","published_at":"2023-02-08T21:33:24Z","references":["https://osv.dev/vulnerability/GHSA-r4f8-f93x-5qh3","https://github.com/TYPO3/typo3/security/advisories/GHSA-r4f8-f93x-5qh3","https://nvd.nist.gov/vuln/detail/CVE-2023-24814","https://github.com/TYPO3/typo3/commit/0005a6fd86ab97eff8bf2e3a5828bf0e7cb6263a","https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Setup/Config/Index.html#absrefprefix","https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2023-24814.yaml","https://github.com/TYPO3/typo3","https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/core/Classes/Utility/GeneralUtility.php#L2481-L2484","https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php#L2547-L2549","https://typo3.org/security/advisory/typo3-core-sa-2023-001","https://typo3.org/security/advisory/typo3-psa-2023-001"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-r4f8-f93x-5qh3#Packagist/typo3/cms","url":"https://osv.dev/vulnerability/GHSA-r4f8-f93x-5qh3"}],"summary":"TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering"}