CVE-2020-26229 XML External Entity in Dashboard Widget

2020-11-2321:15:18

CWE-611

GitHub_M

www.cve.org

typo3

xml

widget

cve-2020-26229

vulnerability

php

rss

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

AI Score

4.1

Confidence

High

EPSS

0.001

Percentile

31.4%

JSON

TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.

CNA Affected

[
  {
    "product": "TYPO3.CMS",
    "vendor": "TYPO3",
    "versions": [
      {
        "status": "affected",
        "version": ">= 10.0.0, < 10.4.10"
      }
    ]
  }
]