-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-form | composer | >= 10.0.0, <= 10.4.47 | 10.4.48 |
| typo3/cms-form | composer | >= 11.0.0, <= 11.5.41 | 11.5.42 |
| typo3/cms-form | composer | >= 12.0.0, <= 12.4.24 | 12.4.25 |
| typo3/cms-form | composer | >= 13.0.0, <= 13.4.2 | 13.4.3 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from state-changing actions accepting HTTP GET requests without CSRF protection. The patch adds 'assertAllowedHttpMethod' checks for POST in initialize() methods for these actions. The affected controllers (FormEditorController and FormManagerController) had action handlers (saveForm, create, duplicate, delete) that lacked these checks prior to the fix. The JavaScript changes in view-model.js further confirm the delete action transitioned from GET to POST. These functions were vulnerable because they allowed CSRF exploitation via GET when security settings were misconfigured.
KEV Misses 88% of Exploited CVEs- Get the report