TYPO3 CMS Open Redirect Vulnerability in Core Utility

A medium-severity open redirect vulnerability has been identified in TYPO3 CMS versions 9.0.0 through 9.5.54, 10.0.0 through 10.4.53, 11.0.0 through 11.5.47, 12.0.0 through 12.4.36, and 13.0.0 through 13.4.17. The vulnerability arises in the 'sanitizeLocalUrl' function of the GeneralUtility class, where improperly sanitized URLs can be exploited to redirect users to arbitrary external sites. This flaw could facilitate phishing attacks by allowing attackers to manipulate and sanitize URLs for malicious purposes.

Impact

Exploitation of this vulnerability could lead to open redirect attacks, where users are redirected to external sites, potentially for phishing purposes.

Remediation

Users are advised to update TYPO3 to versions 9.5.55 ELTS, 10.4.54 ELTS, 11.5.48 ELTS, 12.4.37 LTS, or 13.4.18 LTS, all of which address this vulnerability.