MEDIUM6.5

GHSA-8grp-3j5v-543g

Typo3 Arbitrary Information Disclosure

Quick fix

GHSA-8grp-3j5v-543g — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^4.3.12

Details

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.

Enter the version of the package you're using.

Introduced in: 0Fixed in: 4.3.12

Fixcomposer require typo3/cms:^4.3.12

Introduced in: 4.4.0Fixed in: 4.4.9

Fixcomposer require typo3/cms:^4.4.9

Introduced in: 4.5.0Fixed in: 4.5.4

Fixcomposer require typo3/cms:^4.5.4