Information Disclosure in TYPO3 CMS
Summary
GHSA-g46h-v2cc-6c94: Information Disclosure in TYPO3 CMS. Affects typo3/cms across 2 version ranges.
>= 7.6.0, < 7.6.22
>= 8.0.0, < 8.7.5
Fixed in 7.6.22 or 8.7.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including file storage and rendering of file collections in the frontend. However, a vulnerability has been identified in TYPO3 CMS that could lead to information disclosure.
Vulnerability Detail
The vulnerability in TYPO3 CMS arises from a failure to properly check user permissions on file storages. This allows editors to gain knowledge of protected storages and their folders, as well as use them in a file collection rendered in the frontend. Exploiting this vulnerability requires a valid backend user account. The vulnerability has a CVSS score of 4.3, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.6.0, < 7.6.227.6.22composer require typo3/cms:7.6.22 -
>= 8.0.0, < 8.7.58.7.5composer require typo3/cms:8.7.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to update TYPO3 CMS to the recommended versions to address the issue.
Conclusion
In conclusion, TYPO3 CMS is vulnerable to an information disclosure issue that allows editors to access protected storages and folders. To mitigate this vulnerability, it is crucial to update TYPO3 CMS to the recommended versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for creating and managing websites.
The vulnerability allows editors to gain access to protected storages and folders, potentially exposing sensitive information.
Exploiting this vulnerability requires a valid backend user account in TYPO3 CMS.
To fix this vulnerability, update TYPO3 CMS to the recommended versions: 7.6.22 or higher for versions 7.6.0 to 7.6.21, and 8.7.5 or higher for versions 8.0.0 to 8.7.4.
No specific workaround is provided for this vulnerability. Updating to the recommended versions is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
