GHSA-f777-f784-36gm
TYPO3 Security Misconfiguration in Install Tool Cookie
- Severity
- 8.1 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
- Fix
7.6.32- Upgrade typo3/cms to this version or later
Description
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| typo3/cms | >= 7.0.0, < 7.6.32 |
7.6.32 |
| typo3/cms | >= 8.0.0, < 8.7.21 |
8.7.21 |
| typo3/cms | >= 9.0.0, < 9.5.2 |
9.5.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
typo3/cms Packagist → 7.6.32
- composer
composer require typo3/cms:^7.6.32
Severity breakdown
CVSS 3.1 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
How to prevent it
- Implementation: Leverage the HttpOnly flag when setting a sensitive cookie in a response.
References
Packages
Other links
- github.com/TYPO3/typo3/commit/13328b0f74ac589a20b021db814dfa672581c26a
- github.com/TYPO3/typo3/commit/918e50e4d20d88c7e40ad3bb134267d07706b0b1
- github.com/TYPO3/typo3/commit/a5359491e3fb3164a6ba96a66c8e67fbb9971a4c
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-4.…
- typo3.org/security/advisory/typo3-core-sa-2018-009
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling | Medium | Also affects typo3/cms |
| GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool | Medium | Also affects typo3/cms |
| GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login | Medium | Also affects typo3/cms |
| GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component | Medium | Also affects typo3/cms |
| GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering | Medium | Also affects typo3/cms |
| GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module | High | Also affects typo3/cms |
| GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration | High | Also affects typo3/cms |
| GHSA-f624-8hfq-5fh3 TYPO3 Information Disclosure of Installed Extensions | Medium | Also affects typo3/cms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor