The referrer enforcement introduced in TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective starting with TYPO3 CMS version 13.0. This is because the backend and Install Tool applications began serving from the site's main entry script (site root) rather than a dedicated directory. The system determines request origin by comparing the referrer against the entry script directory, which now is the site root, causing it to accept requests from any script on the TYPO3 instance's domain. Consequently, attackers who can execute JavaScript on the domain (e.g., via cross-site scripting) can invoke backend and Install Tool endpoints using the victim's authenticated session privileges. This affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

An attacker with the ability to execute JavaScript on a TYPO3 instance's domain can bypass origin checks and invoke sensitive backend and Install Tool endpoints with the privileges of an authenticated user. This could lead to unauthorized actions within the backend or installation tools, potentially compromising the integrity and security of the TYPO3 CMS installation. The vulnerability requires the attacker to have some form of script execution on the domain and an authenticated victim session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict or remediate any cross-site scripting vulnerabilities that could enable attacker-controlled JavaScript execution on the TYPO3 domain, as this is a prerequisite for exploitation.