Vulnerability advisory

GHSA-wvvp-jwf5-qcpc

TYPO3 Information Disclosure in Page Tree

Published May 30, 2024Updated Dec 5, 2024OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected versions

typo3/cms-core Packagist

Affected	Fixed in
`9.0.0` to before 9.5.6	`9.5.6`Advisories →
Also listed as affected (15) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5`

Description

It has been discovered backend users not having read access to specific pages still could see them in the page tree which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.

References

Webgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-05-07-4.yaml ↗
Packagegithub.com/TYPO3-CMS/core ↗
Webtypo3.org/security/advisory/typo3-core-sa-2019-009 ↗