CVE-2011-4901: Typo3 Arbitrary Information Disclosure
Summary
CVE-2011-4901: Typo3 Arbitrary Information Disclosure. Affects typo3/cms across 3 version ranges.
< 4.3.12
>= 4.4.0, < 4.4.9
>= 4.5.0, < 4.5.4
Fixed in 4.3.12, 4.4.9 or 4.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Typo3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The vulnerability identified as CVE-2011-4901 affects versions of Typo3 prior to 4.3.12, 4.4.x prior to 4.4.9, and 4.5.x prior to 4.5.4. This vulnerability allows remote attackers to extract arbitrary information from the Typo3 database.
Vulnerability Detail
The vulnerability in Typo3 allows attackers to gain unauthorized access to sensitive information stored in the database. By exploiting this vulnerability, an attacker can extract arbitrary data from the Typo3 database, potentially exposing sensitive user information, configuration details, or other confidential data. This can lead to further security breaches, identity theft, or unauthorized access to the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.124.3.12composer require typo3/cms:4.3.12 -
>= 4.4.0, < 4.4.94.4.9composer require typo3/cms:4.4.9 -
>= 4.5.0, < 4.5.44.5.4composer require typo3/cms:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading to the patched versions of Typo3.
Conclusion
The vulnerability in Typo3 allows remote attackers to extract arbitrary information from the database, potentially leading to unauthorized access and exposure of sensitive data. To mitigate this risk, it is crucial to upgrade to the patched versions of Typo3. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
Typo3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications.
Versions of Typo3 prior to 4.3.12, 4.4.x prior to 4.4.9, and 4.5.x prior to 4.5.4 are affected by this vulnerability.
This vulnerability allows remote attackers to extract arbitrary information from the Typo3 database, potentially exposing sensitive user information, configuration details, or other confidential data.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Typo3: 4.3.12, 4.4.9, or 4.5.4.
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading to the patched versions of Typo3.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
