MEDIUM5.3
GHSA-6487-3qvg-8px9
TYPO3 Information Disclosure in Install Tool
Quick fix
GHSA-6487-3qvg-8px9 — typo3/cms: upgrade to the fixed version with the command below.
composer require typo3/cms:^7.6.32Details
The Install Tool exposes the current TYPO3 version number to non-authenticated users.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/TYPO3/typo3/commit/232d0a64282382229c205904173a16a581555fe3[WEB]
- https://github.com/TYPO3/typo3/commit/b4dd20f31d483f6399e8bcbffcac3e16a2df0d92[WEB]
- https://github.com/TYPO3/typo3/commit/fab0cbc970b709ed65fc4622a2cbd52a197480c4[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-5.yaml[WEB]
- https://github.com/TYPO3/typo3[PACKAGE]
- https://typo3.org/security/advisory/typo3-core-sa-2018-010[WEB]