GitHub Advisoryadvisory · Packagist

GHSA-vpr3-rc99-2wpr Information Disclosure in TYPO3 Backend

MEDIUM Published 2024-06-05 Modified 2024-06-05 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-285
Reviewed
2024-06-05

Affected packages

• Packagist typo3/cms: >= 6.2.0, < 6.2.26 → fixed in 6.2.26 • Packagist typo3/cms: >= 7.6.0, < 7.6.10 → fixed in 7.6.10 • Packagist typo3/cms: >= 8.0.0, < 8.2.1 → fixed in 8.2.1

Description

The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames.

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References