~ / search / GHSA-3x94-fv5h-5q2c

GHSA-3x94-fv5h-5q2c

Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

Source: GitHub Advisory Database (reviewed) High CVE-2020-15099

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms-core >= 9.0.0, < 9.5.20 9.5.20
Packagist typo3/cms-core >= 10.0.0, < 10.4.6 10.4.6
Packagist typo3/cms >= 10.0.0, < 10.4.6 10.4.6
Packagist typo3/cms >= 9.0.0, < 9.5.20 9.5.20

Details

As written in the advisory (Markdown source, shown as plain text).

> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5) > * CWE-20, CWE-200 ### Problem In case an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal _encryptionKey_ was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch _typo3conf/LocalConfiguration.php_ which again contains the _encryptionKey_ as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network, this allows to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. ### Solution Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described. ### Credits Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue. ### References * [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007)

References

External links from the advisory. They lead to third-party sites.