TYPO3 Information Disclosure in Install Tool
Summary
GHSA-66c2-7g4p-wx4p: TYPO3 Information Disclosure in Install Tool. Affects typo3/cms-core across 3 version ranges.
>= 7.0.0, < 7.6.32
>= 8.0.0, < 8.7.21
>= 9.0.0, < 9.5.2
Fixed in 7.6.32, 8.7.21 or 9.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for creating and managing websites. The TYPO3 CMS Core package is responsible for the core functionality of TYPO3. The Install Tool is a web-based tool that allows administrators to configure and manage TYPO3 installations. It provides various features, including system information, database setup, and extension management.
Vulnerability Detail
The Install Tool in TYPO3 exposes the current TYPO3 version number to non-authenticated users. This information disclosure vulnerability can be exploited by attackers to gather intelligence about the TYPO3 installation, potentially aiding in the exploitation of other vulnerabilities or targeted attacks. The vulnerability has a CVSS score of 5.3, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.6.327.6.32composer require typo3/cms-core:7.6.32 -
>= 8.0.0, < 8.7.218.7.21composer require typo3/cms-core:8.7.21 -
>= 9.0.0, < 9.5.29.5.2composer require typo3/cms-core:9.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to apply the recommended fixes by upgrading to the fixed versions.
Conclusion
The TYPO3 Install Tool vulnerability exposes the current TYPO3 version number to non-authenticated users, potentially aiding attackers in targeted attacks or exploiting other vulnerabilities. It is crucial to upgrade to the fixed versions of TYPO3 CMS Core to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for creating and managing websites.
The Install Tool is a web-based tool in TYPO3 that allows administrators to configure and manage TYPO3 installations. It provides various features, including system information, database setup, and extension management.
This vulnerability exposes the current TYPO3 version number to non-authenticated users. Attackers can use this information to gather intelligence about the TYPO3 installation, potentially aiding in the exploitation of other vulnerabilities or targeted attacks.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of TYPO3 CMS Core. For TYPO3 CMS Core version 8.x, upgrade to version 8.7.21 or later. For TYPO3 CMS Core version 9.x, upgrade to version 9.5.2 or later. For TYPO3 CMS Core version 7.x, upgrade to version 7.6.32 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
