TYPO3 Disclosure of Information about Installed Extensions

2024-05-3018:13:02

Google

osv.dev

typo3

information disclosure

requirejs

package loading

security vulnerability

system extensions

6.7 Medium

AI Score

Confidence

Low

JSON

It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.

CPENameOperatorVersion
typo3/cms-coreeq8.7.9
typo3/cms-coreeq8.7.10
typo3/cms-coreeq8.7.20
typo3/cms-coreeq9.1.0
typo3/cms-coreeq8.7.13
typo3/cms-coreeq9.4.0
typo3/cms-coreeq9.3.3
typo3/cms-coreeq8.7.14
typo3/cms-coreeq8.7.15
typo3/cms-coreeq9.5.2

Name	Operator	Version
typo3/cms-core	eq	8.7.9
typo3/cms-core	eq	8.7.10
typo3/cms-core	eq	8.7.20
typo3/cms-core	eq	9.1.0
typo3/cms-core	eq	8.7.13
typo3/cms-core	eq	9.4.0
typo3/cms-core	eq	9.3.3
typo3/cms-core	eq	8.7.14
typo3/cms-core	eq	8.7.15
typo3/cms-core	eq	9.5.2

Rows per page:

1-10 of 291

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-01-22-1.yaml

github.com/TYPO3-CMS/core/commit/7960334bba1223a681283158f67a999334e88cf1

github.com/TYPO3-CMS/core/commit/9453d8a8763fffa76deb6a16f6b99c0ab6f3d8f1

typo3.org/security/advisory/typo3-core-sa-2019-001

6.7 Medium

AI Score

Confidence

Low

JSON