-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 9.0.0, < 9.5.55 | 12.4.37 |
| typo3/cms-core | composer | >= 10.0.0, < 10.4.54 | 12.4.37 |
| typo3/cms-core | composer | >= 11.0.0, < 11.5.48 | 12.4.37 |
| typo3/cms-core | composer | >= 12.0.0, < 12.4.37 | 12.4.37 |
| typo3/cms-core | composer | >= 13.0.0, < 13.4.18 | 13.4.18 |
Miggo AIRoot Cause AnalysisThe vulnerability description directly points to GeneralUtility::sanitizeLocalUrl as the source of the open-redirect vulnerability. The provided commit 862b9da870815132c31119cd85bc454a5010793c is explicitly a security fix for this issue. Analyzing the diff for Classes/Utility/GeneralUtility.php shows that the sanitizeLocalUrl function was modified to add validation against URLs containing whitespace or null-byte characters. This is a direct mitigation for open-redirect attacks where attackers use such characters to fool the URL parser. The added test cases in Tests/Unit/Utility/GeneralUtilityTest.php also confirm the exploit vectors that are now being checked for, such as //evil.site/ and /\r\nX-Injected: evil. Therefore, the TYPO3\CMS\Core\Utility\GeneralUtility::sanitizeLocalUrl function is the identified vulnerable function that would be present in a runtime profile during an exploit.
A Semantic Attack on Google Gemini - Read the Latest Research