TYPO3 Remote File Disclosure Vulnerability in jumpUrl Mechanism
Summary
CVE-2010-3714: TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism. Affects typo3/cms across 3 version ranges.
>= 4.2.0, < 4.2.15
>= 4.3.0, < 4.3.7
>= 4.4.0, < 4.4.4
Fixed in 4.2.15, 4.3.7 or 4.4.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that allows users to create and manage websites. It provides a wide range of features and functionalities for website development, including access tracking through the jumpUrl mechanism. This mechanism is responsible for tracking user access to specific URLs. However, a vulnerability has been discovered in the implementation of the jumpUrl mechanism in TYPO3 versions 4.2.x, 4.3.x, and 4.4.x. This vulnerability allows remote attackers to read arbitrary files on the server by exploiting a flaw in the access-control decision process.
Vulnerability Detail
The vulnerability arises from the improper comparison of certain hash values during access-control decisions in the tslib/class.tslib_fe.php file. This flaw enables attackers to bypass access restrictions and gain unauthorized access to sensitive files on the server. By exploiting this vulnerability, remote attackers can read arbitrary files, potentially exposing sensitive information or compromising the integrity of the system. The exact vectors through which attackers can exploit this vulnerability have not been disclosed.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.154.2.15composer require typo3/cms:4.2.15 -
>= 4.3.0, < 4.3.74.3.7composer require typo3/cms:4.3.7 -
>= 4.4.0, < 4.4.44.4.4composer require typo3/cms:4.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions mentioned above.
Conclusion
The TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism exposes websites to the risk of unauthorized access to sensitive files. To mitigate this vulnerability, it is crucial to upgrade TYPO3 installations to the fixed versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) used for creating and managing websites.
The jumpUrl mechanism in TYPO3 is responsible for tracking user access to specific URLs.
This vulnerability allows remote attackers to read arbitrary files on the server, potentially exposing sensitive information or compromising the system's integrity.
To fix this vulnerability, upgrade your TYPO3 installation to the recommended fixed versions: 4.2.15, 4.3.7, or 4.4.4.
No workaround has been provided. It is recommended to apply the fix by upgrading to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
