Skip to content

Typo3 Information Disclosure in Backend User Interface

Moderate severity GitHub Reviewed Published Jun 5, 2024 to the GitHub Advisory Database • Updated Jun 5, 2024

Package

composer typo3/cms (Composer)

Affected versions

>= 8.0.0, < 8.7.27
>= 9.0.0, < 9.5.8

Patched versions

8.7.27
9.5.8

Description

The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability.

References

Published to the GitHub Advisory Database Jun 5, 2024
Reviewed Jun 5, 2024
Last updated Jun 5, 2024

Severity

Moderate

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-q9c4-9v5m-597p

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.