Vulnerability advisory

GHSA-vpr3-rc99-2wpr

Information Disclosure in TYPO3 Backend

Published Jun 5, 2024Updated Dec 2, 2024OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

typo3/cms Packagist

Affected	Fixed in
`6.2.0` to before 6.2.26	`6.2.26`Advisories →
Also listed as affected (27) `6.2.0` `6.2.1` `6.2.10` `6.2.10-rc1` `6.2.11` `6.2.12` `6.2.13` `6.2.14` `6.2.15` `6.2.16` `6.2.17` `6.2.18` `6.2.19` `6.2.2` `6.2.20` `6.2.21` `6.2.22` `6.2.23` `6.2.24` `6.2.25` `6.2.3` `6.2.4` `6.2.5` `6.2.6` `6.2.7` `6.2.8` `6.2.9`
`7.6.0` to before 7.6.10	`7.6.10`Advisories →
Also listed as affected (10) `7.6.0` `7.6.1` `7.6.2` `7.6.3` `7.6.4` `7.6.5` `7.6.6` `7.6.7` `7.6.8` `7.6.9`
`8.0.0` to before 8.2.1	`8.2.1`Advisories →
Also listed as affected (6) `8.0.0` `8.0.1` `8.1.0` `8.1.1` `8.1.2` `8.2.0`

Description

The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames.

GHSA-vpr3-rc99-2wpr

Affected versions

typo3/cms Packagist

Description

References