---
title: "TYPO3-PSA-2014-001: Cross-Site Request Forgery Protection in TYPO3 CMS 6.2"
url: "https://news.typo3.com/security/advisory/typo3-psa-2014-001"
description: TYPO3 CMS 6.2 will get CSRF Protection throughout all modules and parts that manipulate data.
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - The Project
  - Public Service Announcement
---

# TYPO3-PSA-2014-001: Cross-Site Request Forgery Protection in TYPO3 CMS 6.2

- [The Project](https://news.typo3.com/article/category/the-project)
- Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement)

TYPO3-PSA-2014-001: Cross-Site Request Forgery Protection in TYPO3 CMS 6.2
==========================================================================

28 January 2014

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

TYPO3 CMS 6.2 will get CSRF Protection throughout all modules and parts that manipulate data.

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

**Component Type:** TYPO3 CMS

**Vulnerability Types:** Cross-Site Request Forgery (CSRF)

**Overall Severity:** Low

**Release Date:** January 31, 2014

**Affected Versions:** All versions below 6.2

**CVE:** Will be requested.

**Problem Description:** [CSRF](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)) is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With the help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing.

In TYPO3 CMS, protection against CSRF has been implemented for many important actions (like creating, editing or deleting records) but is still missing in other places (like Extension Manager, file upload, configuration module).

The upcoming 6.2 LTS version will finally close this gap and will protect editors or administrators from these kind of attacks.

Since this kind of security improvement cannot be done without potentially breaking third party extensions, this additional security feature will only be part of TYPO3 CMS 6.2 and will not be backported to older versions.

**Solution:** Since user action is always involved in this attack technique the risk can be mitigated greatly by not using the default web browser to log into a TYPO3 Backend and always log out once the work is finished. It is also suggested to not visit any other website in the same browser while being logged in. Update to TYPO3 CMS 6.2 is suggested (once released), but not strictly required if the mitigation strategies described above are taken into account.

**General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Opens external link in new window"). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list.

**General Note:** All security related code changes are tagged so that you can easily look them up on our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z).

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

[More posts by this author](https://news.typo3.com/article/author/zoe-legacy)