Vulnerability · Published Jul 29, 2020 · Assigned by GitHub_M
CVE-2020-15098Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
High 8.8
In plain English
A high-severity improper input validation in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | typo3/cms | 10.4.6 | GHSA-m5vr-3m74-jwxp |
| Packagist | typo3/cms | 9.5.20 | GHSA-m5vr-3m74-jwxp |
| Packagist | typo3/cms-core | 9.5.20 | GHSA-m5vr-3m74-jwxp |
| Packagist | typo3/cms-core | 10.4.6 | GHSA-m5vr-3m74-jwxp |
Affected products (as reported)
Weakness: CWE-325, CWE-20, CWE-200, CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxp x_refsource_CONFIRM
- https://typo3.org/security/advisory/typo3-core-sa-2016-013 x_refsource_MISC
- https://typo3.org/security/advisory/typo3-core-sa-2020-008 x_refsource_MISC
- https://github.com/TYPO3/TYPO3.CMS/commit/85d3e70dff35a99ef53f4b561114acfa9e5c47e1 x_refsource_MISC