Vulnerability advisory

CVE-2023-38499

typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution

Published Jul 25, 2023Updated Oct 28, 2026OSV record ↗

Also known as BIT-typo3-2023-38499GHSA-jq6g-4v5m-wm9r

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 to before 9eaf8f29875a17b5d48f296d83c1f58b24288b7c	`9eaf8f29875a17b5d48f296d83c1f58b24288b7c`
36096733dea4bd6f6168209609fa879dc25c0138 to before 2312505703ced9702bcc07fc7e0280810be78ee2	`2312505703ced9702bcc07fc7e0280810be78ee2`
Not specified	`702e2debd4b28f9cdb540544565fe6a8627ccb6a`
Also listed as affected (43) `v11.5.29` `v12.4.3` `v11.5.28` `v12.4.2` `v12.4.1` `v11.5.27` `v12.4.0` `v11.5.26` `v12.3.0` `v11.5.25` `v11.5.24` `v12.2.0` `v11.5.23` `v11.5.22` `v11.5.21` `v11.5.20` `v12.1.0` `v11.5.19` `v11.5.18` `v11.5.17` `v12.0.0` `v11.5.16` `v11.5.15` `v11.5.14` `v11.5.13` `v11.5.12` `v11.5.11` `v11.5.10` `v11.5.9` `v11.5.8` `v11.5.7` `v11.5.6` `v11.5.5` `v11.5.4` `v11.5.3` `v11.5.2` `v11.5.1` `v11.5.0` `v11.4.0` `v11.3.0` `v11.2.0` `v11.1.0` `v11.0.0`

Description

TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.

CVE-2023-38499

Affected versions

Repository

Description

References