Vulnerability · Published May 13, 2020 · Assigned by GitHub_M
CVE-2020-11063Observable Response Discrepancy in TYPO3 CMS
Low 3.7
In plain English
A low-severity security flaw in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)1.2%top 31.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | typo3/cms | 10.4.2 | GHSA-347x-877p-hcwx |
| Packagist | typo3/cms-core | 10.4.2 | GHSA-347x-877p-hcwx |
Affected products (as reported)
Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx x_refsource_CONFIRM
- https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574 x_refsource_MISC
- https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx x_refsource_CONFIRM, x_transferred