BIT-typo3-2022-23501

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/typo3/BIT-typo3-2022-23501.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-typo3-2022-23501
Aliases
Published
2024-03-06T11:10:05.573Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / typo3

Package

Name
typo3
Purl
pkg:bitnami/typo3

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.7.49
Introduced
9.0.0
Fixed
9.5.38
Introduced
10.0.0
Fixed
10.4.33
Introduced
11.0.0
Fixed
11.5.20
Introduced
12.0.0
Fixed
12.1.1