Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Informationen offenzulegen und seine Rechte zu erweitern.
Product
TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 2
-
High 8.8
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbit…
-
High 8.1
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a diffe…
Revision history
-
#2
PoC aufgenommen
-
#1
Initiale Fassung
References
-
TYPO3 Security Advisory vom 2020-07-27
https://typo3.org/security/advisory/typo3-core-sa-2020-007
-
TYPO3 Security Advisory vom 2020-07-27
https://typo3.org/security/advisory/typo3-core-sa-2020-008
-
PoC auf GitHub vom 2026-03-15
https://github.com/StillSoul/CVE-2020-15099