Information Disclosure in TYPO3 Backend
Summary
GHSA-vpr3-rc99-2wpr: Information Disclosure in TYPO3 Backend. Affects typo3/cms across 3 version ranges.
>= 6.2.0, < 6.2.26
>= 7.6.0, < 7.6.10
>= 8.0.0, < 8.2.1
Fixed in 6.2.26, 7.6.10 or 8.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a backend module for authenticated backend users to perform administrative tasks. However, a vulnerability exists in the TYPO3 backend module that can lead to information disclosure.
Vulnerability Detail
The TYPO3 backend module stores the username of an authenticated backend user in its cache files. An attacker can exploit this vulnerability by guessing the file path to the cache files and retrieve valid backend usernames. This information disclosure can potentially lead to unauthorized access and compromise the security of the TYPO3 CMS installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.2.0, < 6.2.266.2.26composer require typo3/cms:6.2.26 -
>= 7.6.0, < 7.6.107.6.10composer require typo3/cms:7.6.10 -
>= 8.0.0, < 8.2.18.2.1composer require typo3/cms:8.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The information disclosure vulnerability in the TYPO3 backend module can allow unauthorized access to backend usernames. TYPO3 CMS users should upgrade to the fixed versions of the affected packages to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for creating and managing websites.
The TYPO3 backend module is a component of TYPO3 CMS that provides an administrative interface for managing the CMS.
Information disclosure refers to the unintentional exposure of sensitive information to unauthorized individuals or systems.
The information disclosure vulnerability in the TYPO3 backend module can lead to unauthorized access to backend usernames, potentially compromising the security of the CMS installation.
To protect your TYPO3 CMS installation, it is recommended to upgrade to the fixed versions of the affected packages as mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
