Information Disclosure in TYPO3 Backend

2024-06-0515:01:46

Google

osv.dev

typo3

backend

cache

usernames

6.9 Medium

AI Score

Confidence

High

JSON

The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames.

CPENameOperatorVersion
typo3/cmseq6.2.11
typo3/cmseq6.2.5
typo3/cmseq8.1.2
typo3/cmseq7.6.6
typo3/cmseq6.2.0
typo3/cmseq6.2.25
typo3/cmseq6.2.13
typo3/cmseq7.6.4
typo3/cmseq8.0.0
typo3/cmseq8.2.0

Name	Operator	Version
typo3/cms	eq	6.2.11
typo3/cms	eq	6.2.5
typo3/cms	eq	8.1.2
typo3/cms	eq	7.6.6
typo3/cms	eq	6.2.0
typo3/cms	eq	6.2.25
typo3/cms	eq	6.2.13
typo3/cms	eq	7.6.4
typo3/cms	eq	8.0.0
typo3/cms	eq	8.2.0

Rows per page:

1-10 of 431

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-07-19-4.yaml

typo3.org/security/advisory/typo3-core-sa-2016-017

typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-017

6.9 Medium

AI Score

Confidence

High

JSON