Lucene search
Veracode Vulnerability DatabaseVERACODE:47553HistoryJun 14, 2024 - 12:11 p.m.
Insecure Deserialization
2024-06-1412:11:44
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
typo3
cms
insecure deserialization
user-submitted payloads
signed payloads
hmac-sha1
encryptionkey
attackers
malicious payload
6.9 Medium
AI Score
Confidence
High
typo3/cms is vulnerable to Insecure Deserialization. The vulnerability is due to improper handling of user-submitted payloads that are signed with an HMAC-SHA1 using the sensitive TYPO3 encryptionKey as the secret. If the encryptionKey is known to attackers, they can craft a malicious payload that can be deserialized.
6.9 Medium
AI Score
Confidence
High