TYPO3 Information Disclosure in Backend User Interface
Summary
GHSA-rv8r-8mh5-5376: TYPO3 Information Disclosure in Backend User Interface. Affects typo3/cms-core across 2 version ranges.
>= 8.0.0, < 8.7.27
>= 9.0.0, < 9.5.8
Fixed in 8.7.27 or 9.5.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It provides a flexible and extensible platform for building websites and web applications. The TYPO3 CMS Core package is responsible for the core functionality of TYPO3. It includes features such as user management, content editing, and backend administration. However, a vulnerability has been discovered in the backend user interface of TYPO3 CMS Core.
Vulnerability Detail
The vulnerability in TYPO3 CMS Core allows for information disclosure in the backend user interface. Specifically, the element information component used to display properties of a certain record is susceptible to this issue. The list of references from or to the record is not properly checked for the backend user's permissions. As a result, an attacker with a valid backend user account can exploit this vulnerability to gain unauthorized access to sensitive information. This can include details about other records, potentially leading to further security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.278.7.27composer require typo3/cms-core:8.7.27 -
>= 9.0.0, < 9.5.89.5.8composer require typo3/cms-core:9.5.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to apply the recommended fix by upgrading to the fixed versions of TYPO3 CMS Core.
Conclusion
The information disclosure vulnerability in TYPO3 CMS Core can lead to unauthorized access to sensitive information in the backend user interface. It is important for TYPO3 users to upgrade to the fixed versions (8.7.27 or 9.5.8) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS Core is the central package of the TYPO3 content management system. It provides the core functionality and features for building and managing websites.
The information disclosure vulnerability in TYPO3 CMS Core allows attackers with valid backend user accounts to access sensitive information in the backend user interface. This can potentially lead to further security breaches and unauthorized access to confidential data.
No, only TYPO3 CMS Core versions 8.0.0 to 8.7.27 and versions 9.0.0 to 9.5.8 are affected by this information disclosure vulnerability. Users of other versions are not impacted.
Yes, TYPO3 has released fixed versions (8.7.27 and 9.5.8) that include the necessary patches to address the information disclosure vulnerability. Users should upgrade to these versions to mitigate the risk.
You can find more information about this vulnerability, including the technical details and the fixed versions, in the TYPO3 CMS Core advisory on the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
