GitHub Advisoryadvisory · Packagist

GHSA-87hc-phmj-rhgh TYPO3 Information Disclosure Vulnerability

MEDIUM Published 2022-05-13 Modified 2024-04-25 Official page ↗
Aliases
CVE-2017-6370
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-319
Reviewed
2024-04-25

Affected packages

• Packagist typo3/cms: 7.6.15 (no fix yet)

Description

TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

Related

Alias · CVE (1)

  • CVE-2017-6370 TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References