Log in Start free

Vulnerability · Published May 13, 2020 · Assigned by GitHub_M

CVE-2020-11066Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS

High 8.7

In plain English

A high-severity security flaw in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)1.5%top 25.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically-determined object attributes and result in triggering deletion of an arbitrary directory in the file system, if it is writable for the web server. It can also trigger message submission via email using the identity of the web site (mail relay). Another insecure deserialization vulnerability is required to actually exploit mentioned aspects. This has been fixed in 9.5.17 and 10.4.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms10.4.2GHSA-2rxh-h6h9-qrqc
Packagisttypo3/cms9.5.17GHSA-2rxh-h6h9-qrqc
Packagisttypo3/cms-core9.5.17GHSA-2rxh-h6h9-qrqc
Packagisttypo3/cms-core10.4.2GHSA-2rxh-h6h9-qrqc

Affected products (as reported)

VendorProductVersions
TYPO3 TYPO3 CMS >= 9.0.0, < 9.5.17>= 10.0.0, < 10.4.2

Weakness: CWE-915 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

References