TYPO3 Information Disclosure Vulnerability in typo3/cms
Summary
GHSA-r287-hc8j-w56h: TYPO3 Information Disclosure Vulnerability Exploitable by Editors. Affects typo3/cms across 2 version ranges.
>= 6.2.0, < 6.2.14
>= 7.0.0, < 7.3.1
Fixed in 6.2.14 or 7.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building and managing websites. The typo3/cms package is a core component of TYPO3 CMS, providing essential functionality for content editing, file management, and user authentication. This vulnerability affects versions 6.2.0 to 6.2.14 and 7.0.0 to 7.3.1 of the typo3/cms package.
Vulnerability Detail
The vulnerability allows editors with access to the file list module to list all file names and folder names in the root directory of a TYPO3 installation. While modification of files, listing further nested directories, or retrieving file contents is not possible, this information disclosure can still pose a risk to the security of the system. An attacker with knowledge of sensitive file names or folder structure could potentially exploit this information to plan further attacks or gain unauthorized access to sensitive data. To exploit this vulnerability, a valid backend user account is required.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.2.0, < 6.2.146.2.14composer require typo3/cms:6.2.14 -
>= 7.0.0, < 7.3.17.3.1composer require typo3/cms:7.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, administrators can mitigate the risk by ensuring that only trusted editors have access to the file list module. Additionally, regular monitoring of backend user accounts and file system permissions can help detect and prevent unauthorized access.
Conclusion
The TYPO3 CMS typo3/cms package is vulnerable to an information disclosure issue that allows editors to list file and folder names in the root directory. While no direct modification or access to file contents is possible, this vulnerability can still pose a risk to system security. TYPO3 CMS users should upgrade to the latest version of the typo3/cms package to fix this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for building and managing websites.
Users of TYPO3 CMS versions 6.2.0 to 6.2.14 and 7.0.0 to 7.3.1 with the typo3/cms package installed are affected.
While the vulnerability only allows listing file and folder names, an attacker with knowledge of sensitive file names or folder structure could potentially plan further attacks or gain unauthorized access to sensitive data.
Yes, TYPO3 CMS users should upgrade to the latest version of the typo3/cms package to fix this vulnerability.
Administrators can limit access to the file list module to trusted editors and regularly monitor backend user accounts and file system permissions.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
