Privilege Escalation in TYPO3 CMS
Summary
GHSA-v5jp-4h2p-j2p4: Privilege Escalation in TYPO3 CMS. Affects typo3/cms across 3 version ranges.
>= 6.2.0, < 6.2.20
>= 7.6.0, < 7.6.5
>= 8.0.0, < 8.0.1
Fixed in 6.2.20, 7.6.5 or 8.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including user management, content editing, and version control. However, a vulnerability has been discovered in TYPO3 CMS that could lead to privilege escalation.
Vulnerability Detail
The vulnerability in TYPO3 CMS allows a privileged user to abuse the workspace/version preview link and gain certain editing permissions. This can be exploited if the admin panel is configured to be shown. An attacker would need a valid preview link to exploit this vulnerability. The impact of this vulnerability is moderate, as it can potentially allow unauthorized users to gain elevated privileges within the CMS.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.2.0, < 6.2.206.2.20composer require typo3/cms:6.2.20 -
>= 7.6.0, < 7.6.57.6.5composer require typo3/cms:7.6.5 -
>= 8.0.0, < 8.0.18.0.1composer require typo3/cms:8.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the recommended fix by updating their TYPO3 CMS installations to the latest patched versions.
Conclusion
In conclusion, TYPO3 CMS is vulnerable to privilege escalation, which can allow unauthorized users to gain elevated privileges within the system. It is crucial for TYPO3 CMS users to update their installations to the latest patched versions to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for creating and managing websites.
Privilege escalation is the act of exploiting a vulnerability to gain higher levels of access or privileges within a system or application.
This vulnerability can be exploited by a privileged user who can abuse the workspace/version preview link to gain certain editing permissions.
The impact of this vulnerability is moderate, as it can potentially allow unauthorized users to gain elevated privileges within the TYPO3 CMS.
To fix this vulnerability, users should update their TYPO3 CMS installations to the latest patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
