TYPO3 Improper Access Control Vulnerability in typo3/cms
Summary
CVE-2011-4904: Typo3 Improper Access Control. Affects typo3/cms across 2 version ranges.
< 4.4.9
>= 4.5.0, < 4.5.4
Fixed in 4.4.9 or 4.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building and managing websites. The typo3/cms package is a core component of TYPO3 CMS, providing essential functionality for content creation, management, and presentation. However, versions before 4.4.9 and 4.5.x before 4.5.4 are vulnerable to an improper access control issue.
Vulnerability Detail
The TYPO3 CMS versions mentioned above do not properly apply access control on ExtDirect calls. This allows remote attackers to retrieve ExtDirect endpoint services, potentially leading to unauthorized access and information disclosure. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. It was published on April 22, 2022, and last modified on January 12, 2024.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.4.94.4.9composer require typo3/cms:4.4.9 -
>= 4.5.0, < 4.5.44.5.4composer require typo3/cms:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to update TYPO3 CMS to the patched versions mentioned above.
Conclusion
The TYPO3 CMS package, specifically versions before 4.4.9 and 4.5.x before 4.5.4, is vulnerable to an improper access control issue. This can potentially lead to unauthorized access and information disclosure. It is crucial to update TYPO3 CMS to the recommended patched versions to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for building and managing websites.
ExtDirect is a remote procedure call (RPC) framework used in TYPO3 CMS for client-server communication.
The vulnerability allows remote attackers to retrieve ExtDirect endpoint services, potentially leading to unauthorized access and information disclosure.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
To fix this vulnerability, update TYPO3 CMS to version 4.4.9 or later for versions before 4.5.0, and to version 4.5.4 or later for versions between 4.5.0 and 4.5.4.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
