Privilege Escalation in TYPO3 CMS · GHSA-v5jp-4h2p-j2p4 · GitHub Advisory Database · GitHub

Privilege Escalation in TYPO3 CMS

Moderate severity GitHub Reviewed Published Jun 5, 2024 to the GitHub Advisory Database

Package

typo3/cms (Composer)

Affected versions

>= 6.2.0, < 6.2.20

>= 7.6.0, < 7.6.5

>= 8.0.0, < 8.0.1

Patched versions

6.2.20

7.6.5

8.0.1

Description

The workspace/ version preview link created by a privileged (backend) user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability.

References

Published to the GitHub Advisory Database Jun 5, 2024

Reviewed Jun 5, 2024

Severity

Moderate

6.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N