Project

General

Profile

Actions
Copy link

Bug #104410

closed

Create new content element - Forbidden (Error 403) on Apache 2.4.60+

Added by Eric Harrer 10 days ago. Updated 8 days ago.

Status:
Rejected
Priority:
Won't have this time
Assignee:
-
Category:
Backend User Interface
Target version:
-
Start date:
2024-07-17
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
6.2
PHP Version:
Tags:
security, apache, error, 403, forbidden, CVE-2024-38474, UnsafeAllow3F
Complexity:
Is Regression:
Sprint Focus:

Description

When opening the New Content Element Wizard, the following error message appears:

Forbidden
You don't have permission to access this resource.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

Since version 2.4.60, Apache has closed the security vulnerability https://www.cve.org/CVERecord?id=CVE-2024-38474 by no longer allowing encoded question marks in URLs. This leads to the problem described above. Similar problems have also been reported in the Contao community.

By setting the UnsafeAllow3F flag, the original behaviour of the server can be restored. However, there are already the first web hosting providers, especially in shared hosting, who understandably do not allow this. A current example is STRATO, which recently upgraded to Apache 2.4.61

For this reason, the question now arises as to whether this is an issue for TYPO3 core development or whether there is a possibility that Apache will provide another, less far-reaching, solution for the security vulnerability.

Actions
Copy link

Also available in: Atom PDF