CVE-2020-11066: Class destructors causing side-effects when being unserialized in TYPO3 CMS
Summary
CVE-2020-11066: Class destructors causing side-effects when being unserialized in TYPO3 CMS. Affects typo3/cms-core across 2 version ranges.
>= 9.0.0, < 9.5.17
>= 10.0.0, < 10.4.2
Fixed in 9.5.17 or 10.4.2, depending on the release line you run. How to fix ↓
Also tracked for
- typo3 · Bitnami
The same CVE-2020-11066 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a range of features and functionalities for website development, including content editing, user management, and extension integration. The TYPO3 CMS package, specifically the typo3/cms-core, is susceptible to a vulnerability that involves class destructors causing side-effects during the unserialization process.
Vulnerability Detail
The vulnerability arises when the unserialize() function is called on user-submitted content. This can lead to two potential scenarios: firstly, it can trigger the deletion of an arbitrary directory in the file system if it is writable for the web server. Secondly, it can trigger the submission of a message via email using the identity of the website, potentially acting as a mail relay. However, it is important to note that another insecure deserialization vulnerability is required to exploit these aspects. The vulnerability has a CVSS score of 8.7, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.179.5.17composer require typo3/cms-core:9.5.17 -
>= 10.0.0, < 10.4.210.4.2composer require typo3/cms-core:10.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the TYPO3 CMS package, specifically the typo3/cms-core, is vulnerable to a class destructor-related issue during the unserialization process. This can potentially result in the deletion of arbitrary directories and unauthorized email submissions. To mitigate this vulnerability, it is crucial to update to TYPO3 versions 9.5.17 or 10.4.2. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS is an open-source content management system used for website development and management.
The vulnerability can potentially lead to the deletion of arbitrary directories in the file system and unauthorized email submissions.
To fix this vulnerability, update your TYPO3 CMS installation to versions 9.5.17 or 10.4.2.
No specific workaround has been mentioned for this vulnerability.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
