CVE-2010-3673: Information Disclosure in TYPO3 HTML Mailing API
Summary
CVE-2010-3673: TYPO3 is vulnerable to Information Disclosure in the HTML mailing API. Affects typo3/cms-core across 3 version ranges.
< 4.2.13
>= 4.3, < 4.3.4
>= 4.4, < 4.4.1
Fixed in 4.2.13, 4.3.4 or 4.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) used for building and managing websites. It provides a wide range of features and functionalities for creating and organizing web content. The TYPO3 CMS Core package is a fundamental component of TYPO3, responsible for core functionalities and APIs. However, versions before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 are vulnerable to an information disclosure issue in the HTML mailing API.
Vulnerability Detail
The vulnerability in TYPO3 allows an attacker to obtain sensitive information by exploiting the mail header of the HTML mailing API. This could lead to the disclosure of confidential data, such as email addresses or other personally identifiable information. The issue arises due to improper handling of mail headers in the affected versions of TYPO3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.2.134.2.13composer require typo3/cms-core:4.2.13 -
>= 4.3, < 4.3.44.3.4composer require typo3/cms-core:4.3.4 -
>= 4.4, < 4.4.14.4.1composer require typo3/cms-core:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the fixed versions of TYPO3.
Conclusion
In conclusion, TYPO3 versions before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 are vulnerable to an information disclosure issue in the HTML mailing API. This vulnerability can lead to the disclosure of sensitive information. It is crucial to upgrade TYPO3 to the fixed versions to mitigate the risk and ensure the security of the application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 is an open-source content management system (CMS) used for building and managing websites. It provides a wide range of features and functionalities for creating and organizing web content.
The HTML mailing API in TYPO3 is a feature that allows users to send HTML-based emails directly from the CMS. It provides a convenient way to create and send visually appealing emails to recipients.
The information disclosure vulnerability in TYPO3 occurs due to improper handling of mail headers in the HTML mailing API. This allows an attacker to obtain sensitive information by exploiting the mail header.
The potential consequences of this vulnerability include the disclosure of confidential information, such as email addresses or other personally identifiable information. This can lead to privacy breaches and potential misuse of the obtained data.
To fix this vulnerability, it is recommended to upgrade TYPO3 to the fixed versions mentioned in the 'how_to_fix' section. Upgrading will address the information disclosure issue and ensure the security of the HTML mailing API.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
