GitHub Advisoryadvisory · Packagist

GHSA-7gg8-3r6j-5g55 Typo3 Backend Configuration XSS Vulnerability

LOW Published 2022-05-17 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-3529
Ecosystem
Packagist
Packages
typo3/cms
Severity
Low
Weaknesses
CWE-200
Reviewed
2024-01-12

Affected packages

• Packagist typo3/cms: >= 4.5, < 4.5.19 → fixed in 4.5.19 • Packagist typo3/cms: >= 4.6, < 4.6.12 → fixed in 4.6.12 • Packagist typo3/cms: >= 4.7, < 4.7.4 → fixed in 4.7.4

Description

The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2012-3529 The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References