CVE-2010-3664: TYPO3 Information Disclosure on the Backend
Summary
CVE-2010-3664: TYPO3 is vulnerable to Information Disclosure on the backend. Affects typo3/cms-backend across 4 version ranges.
< 4.1.14
>= 4.2.0, < 4.2.13
>= 4.3.0, < 4.3.4
>= 4.4.0, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) used for building and managing websites. It provides a backend interface for administrators to manage content, users, and system settings. The TYPO3 CMS backend is vulnerable to an information disclosure issue.
Vulnerability Detail
The vulnerability in TYPO3 versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allows an attacker to gain unauthorized access to sensitive information on the backend. This can lead to the exposure of confidential data, such as user credentials or system configurations. The vulnerability is rated as moderate with a CVSS score of 6.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.144.1.14composer require typo3/cms-backend:4.1.14 -
>= 4.2.0, < 4.2.134.2.13composer require typo3/cms-backend:4.2.13 -
>= 4.3.0, < 4.3.44.3.4composer require typo3/cms-backend:4.3.4 -
>= 4.4.0, < 4.4.14.4.1composer require typo3/cms-backend:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided patches or update TYPO3 to the fixed versions.
Conclusion
TYPO3 CMS backend is vulnerable to an information disclosure issue. It is crucial to update TYPO3 to the fixed versions or apply the provided patches to mitigate the risk of unauthorized access to sensitive information. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-backend →
FAQ
TYPO3 is an open-source content management system used for building and managing websites.
The vulnerability allows unauthorized access to sensitive information on the TYPO3 backend, potentially exposing confidential data.
To fix this vulnerability, update TYPO3 to the recommended versions or apply the provided patches.
No, there is no known workaround. Updating TYPO3 is the recommended solution.
The vulnerability is rated as moderate with a CVSS score of 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
