CVE-2026-47347
Essential information
- Published
- 09/06/2026 11:16
- Modified
- 09/06/2026 13:46
- Author
- —
- Creator
- —
- CVSS
- 5.3 MEDIUM (v3) 5.3 MEDIUM (v4.0)
- CISA KEV
- No
- CWE
- —
- CVSS vector
-
—
—
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS metrics
- Access vector
- —
- Access complexity
- —
- Authentication
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploitability
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- —
- Attack complexity
- —
- Privileges required
- —
- User interaction
- —
- Scope
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploit code maturity
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- NETWORK
- Attack complexity
- LOW
- Attack requirements
- NONE
- Privileges required
- NONE
- User interaction
- PASSIVE
- Confidentiality (V)
- NONE
- Confidentiality (S)
- NONE
- Integrity (V)
- NONE
- Integrity (S)
- LOW
- Availability (V)
- NONE
- Availability (S)
- NONE
- Exploit maturity
- NOT_DEFINED
Description
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
NVD status
- Status
- Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
- Source
- f4fb688c-4412-4426-b4b8-421ecf27b14a
- NVD
- View on NVD
Affected products (CPE)
| Product | CPE |
|---|---|
| typo3 / typo3 cms | cpe:2.3:a:typo3:typo3_cms:<10.4.57:*:*:*:*:*:*:* |
| typo3 / typo3 cms | cpe:2.3:a:typo3:typo3_cms:11.0.0-11.5.50:*:*:*:*:*:*:* |
| typo3 / typo3 cms | cpe:2.3:a:typo3:typo3_cms:12.0.0-12.4.45:*:*:*:*:*:*:* |
| typo3 / typo3 cms | cpe:2.3:a:typo3:typo3_cms:13.0.0-13.4.30:*:*:*:*:*:*:* |
| typo3 / typo3 cms | cpe:2.3:a:typo3:typo3_cms:14.0.0-14.3.2:*:*:*:*:*:*:* |