GHSA-h47m-3f78-qp9g
TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key
Quick fix
GHSA-h47m-3f78-qp9g — typo3/cms-core: upgrade to the fixed version with the command below.
composer require typo3/cms-core:^8.7.57Details
### Problem The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.
### Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
### Credits Thanks to TYPO3 core & security team member Benjamin Franzke who fixed the issue.
### References * [TYPO3-CORE-SA-2024-004](https://typo3.org/security/advisory/typo3-core-sa-2024-004)
Are you affected?
Enter the version of the package you're using.
Affected packages
8.0.0Fixed in: 8.7.57composer require typo3/cms-core:^8.7.579.0.0Fixed in: 9.5.46composer require typo3/cms-core:^9.5.4610.0.0Fixed in: 10.4.43composer require typo3/cms-core:^10.4.4311.0.0Fixed in: 11.5.35composer require typo3/cms-core:^11.5.3512.0.0Fixed in: 12.4.11composer require typo3/cms-core:^12.4.1113.0.0Fixed in: 13.0.1composer require typo3/cms-core:^13.0.1References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-h47m-3f78-qp9g[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-25119[ADVISORY]
- https://github.com/TYPO3/typo3/commit/14d101359c71ee963cf51ad0c8ae777b7b9ec9a1[WEB]
- https://github.com/TYPO3/typo3/commit/df486372ea56fac241d3c96ad43a7729fee64557[WEB]
- https://github.com/TYPO3/typo3/commit/fa12667c046342ebfd9b159c646aeafdbc52fcfd[WEB]
- https://github.com/TYPO3/typo3[PACKAGE]
- https://typo3.org/security/advisory/typo3-core-sa-2024-004[WEB]