Skip to content

Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

Moderate
ohader published GHSA-8w3p-qh3x-6gjr Dec 13, 2022

Package

composer typo3/cms-core (Composer)

Affected versions

9.0.0-9.5.37, 10.0.0-10.4.32, 11.0.0-11.5.19, 12.0.0-12.1.0

Patched versions

9.5.38, 10.4.33, 11.5.20, 12.1.1

Description

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C (5.3)

Problem

Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors.

A valid backend user account having administrator privileges is needed to exploit this vulnerability.

Solution

Update to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

Credits

Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.

References

Severity

Moderate
5.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

CVE ID

CVE-2022-23504

Credits