GitHub Advisoryadvisory · Packagist
GHSA-h934-f4m4-wc8x Typo3 Information Disclosure in Page Tree
LOW
Official page ↗
- Ecosystem
- Packagist
- Packages
- typo3/cms
- Severity
- Low
- Reviewed
- 2024-06-05
Affected packages
• Packagist typo3/cms: >= 9.0.0, < 9.5.6 → fixed in 9.5.6
Description
It has been discovered backend users not having read access to specific pages still could see them in the page tree which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.