Lucene search
HistoryMar 05, 2009 - 2:30 a.m.
CVE-2009-0815
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.5 Medium
AI Score
Confidence
Low
0.184 Low
EPSS
Percentile
96.2%
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
Affected configurations
Node
typo3typo3Match3.3.x
ORtypo3typo3Match3.5.x
ORtypo3typo3Match3.6.x
ORtypo3typo3Match3.7.x
ORtypo3typo3Match3.8.x
ORtypo3typo3Match4.0
ORtypo3typo3Match4.1
ORtypo3typo3Match4.1.0
ORtypo3typo3Match4.1.2
ORtypo3typo3Match4.1.3
ORtypo3typo3Match4.1.4
ORtypo3typo3Match4.1.5
ORtypo3typo3Match4.1.6
ORtypo3typo3Match4.1.7
ORtypo3typo3Match4.1.8
ORtypo3typo3Match4.1.9
ORtypo3typo3Match4.2
ORtypo3typo3Match4.2.0
ORtypo3typo3Match4.2.1
ORtypo3typo3Match4.2.2
ORtypo3typo3Match4.2.3
ORtypo3typo3Match4.2.4
ORtypo3typo3Match4.2.5
ORtypo3typo3Match4.3alpha1
Related
prion
prion
Cross site request forgery (csrf)
2009-03-05 02:30:00
cvelist
cvelist
CVE-2009-0815
2009-03-05 02:00:00
dsquare
dsquare
Typo3 FD
2012-01-26 00:00:00
cve
cve
CVE-2009-0815
2009-03-05 02:30:00
nessus
nessus
TYPO3 'jumpUrl' Mechanism Information Disclosure
2009-02-12 00:00:00
FreeBSD : typo3 -- XSS and information disclosure (cc47fafe-f823-11dd-94d9-0030843d3802)
2009-02-12 00:00:00
Debian DSA-1720-1 : typo3-src - several vulnerabilities
2009-02-12 00:00:00
freebsd
freebsd
typo3 -- cross-site scripting and information disclosure
2009-02-10 00:00:00
openvas
openvas
TYPO3 jumpUrl File Disclosure Vulnerability (TYPO3-SA-2009-002)
2013-12-26 00:00:00
Debian Security Advisory DSA 1720-1 (typo3-src)
2009-02-13 00:00:00
FreeBSD Ports: typo3
2009-02-13 00:00:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.5 Medium
AI Score
Confidence
Low
0.184 Low
EPSS
Percentile
96.2%
Related for NVD:CVE-2009-0815