CVE-2009-3628: TYPO3 Backend Discloses Encryption Key
Summary
CVE-2009-3628: TYPO3 Backend Discloses Encryption Key. Affects typo3/cms-backend across 4 version ranges.
< 4.0.13
>= 4.1.0, < 4.1.13
>= 4.2.0, < 4.2.10
>= 4.3alpha1, < 4.3beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system (CMS) that allows users to create and manage websites. The TYPO3 Backend is the administrative interface of the CMS, providing users with various tools and functionalities to control the website's content and settings. It is an essential component for TYPO3 administrators to manage their websites effectively. However, a vulnerability has been discovered in the TYPO3 Backend that could potentially expose the encryption key used by the system.
Vulnerability Detail
The TYPO3 Backend in versions 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 is susceptible to a security flaw. This vulnerability allows remote authenticated users to determine the encryption key by exploiting a flaw in the tt_content form element. By submitting crafted input, an attacker can retrieve the encryption key, which can lead to unauthorized access and potential data breaches. This vulnerability poses a moderate risk to TYPO3 installations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.0.134.0.13composer require typo3/cms-backend:4.0.13 -
>= 4.1.0, < 4.1.134.1.13composer require typo3/cms-backend:4.1.13 -
>= 4.2.0, < 4.2.104.2.10composer require typo3/cms-backend:4.2.10 -
>= 4.3alpha1, < 4.3beta24.3beta2composer require typo3/cms-backend:4.3beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to follow the recommended fix and upgrade their TYPO3 installations to the latest patched versions.
Conclusion
The TYPO3 Backend vulnerability allows remote authenticated users to determine the encryption key, posing a moderate risk to TYPO3 installations. To mitigate this risk, it is crucial to upgrade TYPO3 installations to the latest patched versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-backend →
FAQ
TYPO3 is an open-source content management system (CMS) used for creating and managing websites.
The TYPO3 Backend is the administrative interface of the TYPO3 CMS, providing tools and functionalities for website management.
This vulnerability allows remote authenticated users to determine the encryption key, potentially leading to unauthorized access and data breaches.
To fix this vulnerability, upgrade your TYPO3 installation to the latest patched version mentioned in the vulnerability details.
No specific workaround is available. It is recommended to upgrade to the latest patched version.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
