~ / search / GHSA-hwrc-w5gg-f335

GHSA-hwrc-w5gg-f335

TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential

Source: GitHub Advisory Database (reviewed) Moderate CVE-2009-3635

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms <= 4.0.13 no fix listed
Packagist typo3/cms >= 4.1.0, < 4.1.13 4.1.13
Packagist typo3/cms >= 4.2.0, < 4.2.10 4.2.10
Packagist typo3/cms >= 4.3beta1, < 4.3beta2 4.3beta2

Details

As written in the advisory (Markdown source, shown as plain text).

The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.

References

External links from the advisory. They lead to third-party sites.