CVE-2010-3670: Insecure Randomness in TYPO3 CMS-Frontend Forgot Password Function
Summary
CVE-2010-3670: TYPO3 is vulnerable to insecure randomness during hash generation in forgot password function. Affects typo3/cms-frontend across 2 version ranges.
< 4.3.4
>= 4.4.0, < 4.4.1
Fixed in 4.3.4 or 4.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Frontend is a package that provides frontend functionality for TYPO3, an open-source content management system. It allows users to create and manage websites with various features. However, versions before 4.3.4 and 4.4.x before 4.4.1 of TYPO3 CMS-Frontend are vulnerable to insecure randomness during the generation of a hash with the "forgot password" function.
Vulnerability Detail
The vulnerability in TYPO3 CMS-Frontend arises from the insecure randomness used in the hash generation process for the "forgot password" function. This weakness can be exploited by attackers to predict or guess the generated hash, potentially leading to unauthorized access to user accounts. The impact of this vulnerability is considered moderate, with a CVSS score of 4.8. It is crucial to address this issue promptly to prevent potential security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.44.3.4composer require typo3/cms-frontend:4.3.4 -
>= 4.4.0, < 4.4.14.4.1composer require typo3/cms-frontend:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update TYPO3 CMS-Frontend to the latest secure version.
Conclusion
In conclusion, TYPO3 CMS-Frontend versions before 4.3.4 and 4.4.x before 4.4.1 are vulnerable to insecure randomness during hash generation in the "forgot password" function. This vulnerability can potentially lead to unauthorized access to user accounts. It is crucial to update TYPO3 CMS-Frontend to the latest secure version to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-frontend →
FAQ
TYPO3 CMS-Frontend is a package that provides frontend functionality for TYPO3, an open-source content management system.
The vulnerability allows attackers to predict or guess the generated hash, potentially leading to unauthorized access to user accounts.
The CVSS score of this vulnerability is 4.8, indicating a moderate impact.
To fix this vulnerability, update TYPO3 CMS-Frontend to version 4.3.4 or later for versions before 4.4.0, and to version 4.4.1 or later for versions 4.4.0 and above.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the latest secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-frontend.
