CVE-2010-3666: TYPO3 Insecure randomness in uniqid function
Summary
CVE-2010-3666: TYPO3 is vulnerable to Insecure randomness in uniqid function. Affects typo3/cms-install across 4 version ranges.
< 4.1.14
>= 4.2.0, < 4.2.13
>= 4.3.0, < 4.3.4
>= 4.4.0, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) used for building websites and web applications. It provides a wide range of features and functionalities for managing and publishing content. However, versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 are vulnerable to an insecure randomness issue in the uniqid function.
Vulnerability Detail
The vulnerability in TYPO3 arises from the use of insecure randomness in the uniqid function. This can lead to predictable or easily guessable values being generated, which can be exploited by attackers to perform various malicious activities. The lack of proper randomness can compromise the security of sensitive operations and data within the TYPO3 system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.144.1.14composer require typo3/cms-install:4.1.14 -
>= 4.2.0, < 4.2.134.2.13composer require typo3/cms-install:4.2.13 -
>= 4.3.0, < 4.3.44.3.4composer require typo3/cms-install:4.3.4 -
>= 4.4.0, < 4.4.14.4.1composer require typo3/cms-install:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update TYPO3 to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, TYPO3 versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 are vulnerable to an insecure randomness issue in the uniqid function. It is crucial to update TYPO3 to the fixed versions to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-install →
FAQ
TYPO3 is an open-source content management system used for building websites and web applications.
Versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 are affected.
The vulnerability can lead to compromised security of sensitive operations and data within the TYPO3 system.
Update TYPO3 to version 4.1.14, 4.2.13, 4.3.4, or 4.4.1, depending on the installed version.
No specific workaround is mentioned. It is recommended to update TYPO3 to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-install.
