CVE-2020-11067: Insecure Deserialization in Backend User Settings in TYPO3 CMS
Summary
CVE-2020-11067: Insecure Deserialization in Backend User Settings in TYPO3 CMS. Affects typo3/cms-core across 2 version ranges.
>= 9.0.0, < 9.5.17
>= 10.0.0, < 10.4.2
Fixed in 9.5.17 or 10.4.2, depending on the release line you run. How to fix ↓
Also tracked for
- typo3 · Bitnami
The same CVE-2020-11067 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system used for building and managing websites. It provides a wide range of features and functionalities for creating and maintaining web content. The TYPO3 CMS package, specifically the 'typo3/cms-core' package, is susceptible to an insecure deserialization vulnerability in the backend user settings. This vulnerability can be exploited in conjunction with vulnerabilities in third-party components, potentially leading to remote code execution. It is important to note that exploiting this vulnerability requires a valid backend user account.
Vulnerability Detail
The insecure deserialization vulnerability in TYPO3 CMS allows an attacker to manipulate serialized data in the backend user settings. By crafting malicious serialized data, an attacker can execute arbitrary code on the target system. This can result in unauthorized access, data breaches, or complete compromise of the affected TYPO3 CMS installation. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.179.5.17composer require typo3/cms-core:9.5.17 -
>= 10.0.0, < 10.4.210.4.2composer require typo3/cms-core:10.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating to the recommended TYPO3 CMS versions.
Conclusion
The insecure deserialization vulnerability in TYPO3 CMS poses a significant risk to affected installations. It is crucial for website administrators to update their TYPO3 CMS installations to the recommended versions and apply the necessary patches. Regularly monitoring for security updates and following best practices for web application security is essential to maintain the integrity and security of TYPO3 CMS installations. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS is an open-source content management system used for building and managing websites. It offers a wide range of features and functionalities for creating and maintaining web content.
Insecure deserialization is a vulnerability that occurs when an application deserializes untrusted data without proper validation. This can lead to the execution of arbitrary code or other malicious actions.
An attacker can exploit this vulnerability by crafting malicious serialized data in the backend user settings. This can allow them to execute arbitrary code on the target system, potentially leading to unauthorized access or compromise.
The impact of this vulnerability can be severe, as it can lead to remote code execution and compromise of the affected TYPO3 CMS installation. This can result in unauthorized access, data breaches, or other malicious activities.
To protect your TYPO3 CMS installation, it is crucial to update to the recommended versions (9.5.17 or 10.4.2) that include the necessary patches for this vulnerability. Additionally, regularly applying security updates and following best practices for web application security can help mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
