GHSA-347x-877p-hcwx
Information Disclosure in Password Reset
At a glance
- Published
- Updated
- CVE
- CVE-2020-11063
- Aliases
- BIT-typo3-2020-11063
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2. ### References * https://typo3.org/security/advisory/typo3-core-sa-2020-001
Affected packages
| Package | Versions |
|---|---|
| Packagist · typo3/cms-core | introduced 10.0.0, fixed 10.4.2 |
| Packagist · typo3/cms | introduced 10.0.0, fixed 10.4.2 |
References
- https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx WEB
- https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-11063 ADVISORY
- https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574 WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yaml WEB
- https://github.com/TYPO3/typo3 PACKAGE
- https://typo3.org/security/advisory/typo3-core-sa-2020-001 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |