CVE-2020-11066: TYPO3 CMS Insecure Deserialization Vulnerability
Summary
CVE-2020-11066: In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically... Affects typo3 across 2 version ranges.
>= 9.0.0, < 9.5.17
>= 10.0.0, < 10.4.2
Fixed in 9.5.17 or 10.4.2, depending on the release line you run. How to fix ↓
Also tracked for
- typo3/cms-core · Packagist
The same CVE-2020-11066 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including customizable templates, user management, and content editing. However, versions of TYPO3 CMS prior to 9.5.17 and 10.4.2 are vulnerable to an insecure deserialization vulnerability.
Vulnerability Detail
The insecure deserialization vulnerability in TYPO3 CMS allows an attacker to modify dynamically-determined object attributes by calling unserialize() on malicious user-submitted content. This can lead to the deletion of an arbitrary directory in the file system if it is writable for the web server. Additionally, the vulnerability can be exploited to trigger message submission via email using the identity of the web site (mail relay). It's important to note that another insecure deserialization vulnerability is required to fully exploit these aspects. The vulnerability has been fixed in TYPO3 CMS versions 9.5.17 and 10.4.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.179.5.17 -
>= 10.0.0, < 10.4.210.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by updating TYPO3 CMS to the patched versions.
Conclusion
The insecure deserialization vulnerability in TYPO3 CMS can lead to unauthorized modification of object attributes and potential deletion of directories or email submissions. It is crucial to update TYPO3 CMS to the patched versions (9.5.17 or 10.4.2) and review user-submitted content to prevent exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3 →
FAQ
TYPO3 CMS is an open-source content management system used for creating and managing websites.
Insecure deserialization vulnerability occurs when untrusted data is deserialized by a program, leading to potential code execution or other security issues.
The vulnerability can be exploited by calling unserialize() on malicious user-submitted content, allowing an attacker to modify object attributes and potentially delete directories or trigger email submissions.
Yes, the vulnerability has been fixed in TYPO3 CMS versions 9.5.17 and 10.4.2.
To protect your TYPO3 CMS installation, it is recommended to update to the latest patched version (9.5.17 or 10.4.2) and ensure that user-submitted content is properly sanitized.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3.
