Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/TYPO3/typo3 ↗ | |
| 408adc7ac146134aad8690d40935da5ae42dc2b2 through d54b7fc011b9b9d4ecea8196b59fe919c2c09406 | No fix listed |
Also listed as affected (4)
| |
| GIT github.com/typo3/typo3 ↗ | |
| 408adc7ac146134aad8690d40935da5ae42dc2b2 through d54b7fc011b9b9d4ecea8196b59fe919c2c09406 | No fix listed |
| Not specified | 14929b98ecda0ce67329b0f25ca7c01ee85df574 |
Also listed as affected (4)
| |
Description
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.