GitHub Advisoryadvisory · Packagist
GHSA-g46h-v2cc-6c94 Information Disclosure in TYPO3 CMS
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- typo3/cms
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Reviewed
- 2024-06-05
Affected packages
• Packagist typo3/cms: >= 7.6.0, < 7.6.22 → fixed in 7.6.22
• Packagist typo3/cms: >= 8.0.0, < 8.7.5 → fixed in 8.7.5
Description
Failing to properly check user permission on file storages, editors could gain knowledge of protected storages and its folders as well as using them in a file collection being rendered in the frontend. A valid backend user account is needed to exploit this vulnerability.