Typo3 Information Disclosure in Backend User Interface
Summary
GHSA-q9c4-9v5m-597p: Typo3 Information Disclosure in Backend User Interface. Affects typo3/cms across 2 version ranges.
>= 8.0.0, < 8.7.27
>= 9.0.0, < 9.5.8
Fixed in 8.7.27 or 9.5.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Typo3 is a popular content management system (CMS) that allows users to create and manage websites. It provides a backend user interface where administrators can perform various tasks, including managing records and their properties. However, a vulnerability has been discovered in the backend user interface of Typo3 that can lead to information disclosure. This vulnerability allows an attacker to view sensitive information about records without proper authorization.
Vulnerability Detail
The vulnerability in Typo3's backend user interface lies in the element information component used to display properties of a certain record. The component fails to properly check the backend user's permissions when retrieving the list of references from or to the record. As a result, an attacker with a valid backend user account can exploit this vulnerability to access information that they should not have permission to view. This can include sensitive data such as user details, configuration settings, or other confidential information stored within the records.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.278.7.27composer require typo3/cms:8.7.27 -
>= 9.0.0, < 9.5.89.5.8composer require typo3/cms:9.5.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Typo3 is not immediately possible, a temporary workaround can be implemented by restricting access to the backend user interface. This can be done by adjusting user permissions and ensuring that only authorized users have access to the backend. Additionally, it is important to regularly monitor and review user accounts to identify any suspicious or unauthorized activity.
Conclusion
The Typo3 Information Disclosure vulnerability in the backend user interface can lead to unauthorized access to sensitive information. It is crucial to update Typo3 to the latest version to mitigate this vulnerability. Restricting access to the backend user interface and monitoring user accounts can provide temporary protection until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
Typo3 is a popular content management system (CMS) used for creating and managing websites. It provides a backend user interface for administrators to perform various tasks.
This vulnerability allows an attacker with a valid backend user account to access sensitive information that they should not have permission to view. This can include user details, configuration settings, or other confidential data stored within the records.
To fix this vulnerability, it is recommended to update Typo3 to version 8.7.27 or 9.5.8, or later. These versions address the vulnerability and ensure that the backend user interface properly checks permissions before displaying record information.
If upgrading to the latest version of Typo3 is not immediately possible, a temporary workaround can be implemented by restricting access to the backend user interface. This can be done by adjusting user permissions and ensuring that only authorized users have access.
To prevent unauthorized access to the backend user interface, it is important to regularly monitor and review user accounts. Ensure that only authorized users have access and promptly revoke access for any suspicious or unauthorized accounts.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
