BIT-typo3-2023-38499

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/typo3/BIT-typo3-2023-38499.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-typo3-2023-38499
Aliases
Published
2024-03-06T11:08:03.193Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.

References

Affected packages

Bitnami / typo3

Package

Name
typo3
Purl
pkg:bitnami/typo3

Severity

  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
9.4.0
Fixed
9.5.42
Introduced
10.0.0
Fixed
10.4.39
Introduced
11.0.0
Fixed
11.5.30
Introduced
12.0.0
Fixed
12.4.4