CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
9.0%
The plaintext value of $GLOBALS['SYS']['encryptionKey']
was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
Thanks to TYPO3 core & security team member Benjamin Franzke who fixed the issue.
github.com/advisories/GHSA-h47m-3f78-qp9g
github.com/TYPO3/typo3/commit/14d101359c71ee963cf51ad0c8ae777b7b9ec9a1
github.com/TYPO3/typo3/commit/df486372ea56fac241d3c96ad43a7729fee64557
github.com/TYPO3/typo3/commit/fa12667c046342ebfd9b159c646aeafdbc52fcfd
github.com/TYPO3/typo3/security/advisories/GHSA-h47m-3f78-qp9g
nvd.nist.gov/vuln/detail/CVE-2024-25119
typo3.org/security/advisory/typo3-core-sa-2024-004