Riskcovery

CVE-2020-15098

Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS

State
Published
Severity
8.8 High
Published
Jul 29, 2020
Updated
Aug 4, 2024
Reserved
Jun 25, 2020

Read the record on cve.org

Description

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HGitHub_M

Weaknesses

  • CWE-325 Missing Required Cryptographic Step
  • CWE-20 Improper Input Validation
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-502 Deserialization of Untrusted Data

Affected Products

ProductVersions
TYPO3 CMSTYPO3
  • >= 9.0.0, < 9.5.20Affected
  • >= 10.0.0, 10.4.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.