Vulnerability advisory

GHSA-3x94-fv5h-5q2c

Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

Published Jul 29, 2020Updated Jul 8, 2026OSV record ↗

Also known as BIT-typo3-2020-15099CVE-2020-15099

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`9.0.0` to before 9.5.20	`9.5.20`Advisories →
Also listed as affected (29) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.10` `v9.5.11` `v9.5.12` `v9.5.13` `v9.5.14` `v9.5.15` `v9.5.16` `v9.5.17` `v9.5.18` `v9.5.19` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5` `v9.5.6` `v9.5.7` `v9.5.8` `v9.5.9`
`10.0.0` to before 10.4.6	`10.4.6`Advisories →
Also listed as affected (12) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.2` `v10.4.3` `v10.4.4` `v10.4.5`

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`10.0.0` to before 10.4.6	`10.4.6`Advisories →
Also listed as affected (12) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.2` `v10.4.3` `v10.4.4` `v10.4.5`
`9.0.0` to before 9.5.20	`9.5.20`Advisories →
Also listed as affected (29) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.10` `v9.5.11` `v9.5.12` `v9.5.13` `v9.5.14` `v9.5.15` `v9.5.16` `v9.5.17` `v9.5.18` `v9.5.19` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5` `v9.5.6` `v9.5.7` `v9.5.8` `v9.5.9`

Description

Meta

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (7.5)

CWE-20, CWE-200

Problem

In case an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php which again contains the encryptionKey as well as credentials of the database management system being used.

In case a database server is directly accessible either via internet or in a shared hosting network, this allows to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions.

Solution

Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.

Credits

Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

References

TYPO3-CORE-SA-2020-007