CVE-2010-3661: TYPO3 Open Redirection vulnerability on the backend
Summary
CVE-2010-3661: TYPO3 Open Redirection vulnerability on the backend. Affects typo3/cms-backend across 4 version ranges.
< 4.1.14
>= 4.2.0, < 4.2.13
>= 4.3.0, < 4.3.4
>= 4.4.0, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) used for building and managing websites. The TYPO3 CMS backend is the administrative interface that allows users to configure and control the CMS. It provides various features and functionalities for managing content, user permissions, extensions, and more. However, versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 are susceptible to an Open Redirection vulnerability on the backend.
Vulnerability Detail
The Open Redirection vulnerability in TYPO3 allows an attacker to redirect users to malicious websites by manipulating the backend's redirection functionality. By exploiting this vulnerability, an attacker can craft a specially crafted URL that, when clicked by an authenticated backend user, will redirect them to a malicious website. This can lead to various attacks, such as phishing, malware distribution, or stealing sensitive information from the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.144.1.14composer require typo3/cms-backend:4.1.14 -
>= 4.2.0, < 4.2.134.2.13composer require typo3/cms-backend:4.2.13 -
>= 4.3.0, < 4.3.44.3.4composer require typo3/cms-backend:4.3.4 -
>= 4.4.0, < 4.4.14.4.1composer require typo3/cms-backend:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to apply the provided fix by updating TYPO3 to the fixed versions.
Conclusion
The Open Redirection vulnerability in TYPO3 CMS backend can be mitigated by updating the TYPO3 installation to the fixed versions. It is essential to regularly update TYPO3 installations to protect against known vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-backend →
FAQ
TYPO3 is an open-source content management system (CMS) used for building and managing websites. It provides a backend interface for administrators to configure and control the CMS.
The TYPO3 CMS backend is the administrative interface of TYPO3. It allows users to manage content, user permissions, extensions, and other aspects of the CMS.
An Open Redirection vulnerability allows an attacker to redirect users to malicious websites by manipulating the redirection functionality of a web application.
The Open Redirection vulnerability in TYPO3 can be exploited by attackers to redirect users to malicious websites, leading to various attacks such as phishing, malware distribution, or information theft.
To fix this vulnerability, update your TYPO3 installation to the fixed versions: 4.1.14, 4.2.13, 4.3.4, or 4.4.1. Regularly updating TYPO3 installations is recommended to ensure the latest security patches are applied.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
