CVE-2023-38499 typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution

2023-07-2520:54:41

CWE-200

GitHub_M

www.cve.org

typo3

php

web content management

information disclosure

out-of-scope

site resolution

http parameters

elts

multi-site

version 9

version 10

version 11

version 12

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.7%

JSON

TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.

CNA Affected

[
  {
    "vendor": "TYPO3",
    "product": "typo3",
    "versions": [
      {
        "version": ">= 9.4.0, < 9.5.42",
        "status": "affected"
      },
      {
        "version": ">= 10.0.0, < 10.4.39",
        "status": "affected"
      },
      {
        "version": ">= 11.0.0, < 11.5.30",
        "status": "affected"
      },
      {
        "version": ">= 12.0.0, < 12.4.4",
        "status": "affected"
      }
    ]
  }
]