Lucene search

[email protected]CVE-2020-26228

HistoryNov 23, 2020 - 9:15 p.m.

CVE-2020-26228

2020-11-2321:15:12

CWE-312

[email protected]

web.nvd.nist.gov

typo3

php

web content management system

cve-2020-26228

security vulnerability

session identifiers

cleartext

hashing algorithm

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.5%

JSON

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

Affected configurations

Vulners

NVD

Node

typo3typo3Range9.0.0–9.5.23

typo3typo3Range10.0.0–10.4.10

VendorProductVersionCPE
typo3typo3*cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3typo3*cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3	*	cpe:2.3:a:typo3:typo3::::::::
typo3	typo3	*	cpe:2.3:a:typo3:typo3::::::::

CNA Affected

[
  {
    "product": "TYPO3.CMS",
    "vendor": "TYPO3",
    "versions": [
      {
        "status": "affected",
        "version": ">= 9.0.0, < 9.5.23"
      },
      {
        "status": "affected",
        "version": ">= 10.0.0, < 10.4.10"
      }
    ]
  }
]