GHSA-87hc-phmj-rhgh CVE-2017-6370
TYPO3 Information Disclosure Vulnerability
- Severity
- 5.3 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- 0.99%
- Chance of exploitation in the next 30 days. Higher than 62.46% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-319 Cleartext Transmission of Sensitive Information
- Fix
- None yet
- No fixed version published
Description
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| typo3/cms | 1 listed versions | No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.0 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it
- Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
- Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
- Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
- Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling | Medium | Also affects typo3/cms |
| GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool | Medium | Also affects typo3/cms |
| GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie | High | Also affects typo3/cms |
| GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login | Medium | Also affects typo3/cms |
| GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component | Medium | Also affects typo3/cms |
| GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering | Medium | Also affects typo3/cms |
| GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module | High | Also affects typo3/cms |
| GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration | High | Also affects typo3/cms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor