VDB
Sign up
MEDIUM5.3

GHSA-vpr3-rc99-2wpr

Information Disclosure in TYPO3 Backend

Quick fix

GHSA-vpr3-rc99-2wpr — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^6.2.26

Details

The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms
Introduced in: 6.2.0Fixed in: 6.2.26
Fixcomposer require typo3/cms:^6.2.26
Packagist/typo3/cms
Introduced in: 7.6.0Fixed in: 7.6.10
Fixcomposer require typo3/cms:^7.6.10
Packagist/typo3/cms
Introduced in: 8.0.0Fixed in: 8.2.1
Fixcomposer require typo3/cms:^8.2.1

References