Information Disclosure via CSV Download (TYPO3 TYPO3 CMS)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 15 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- TYPO3
- NVD status
- Analyzed
Description
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | TYPO3 |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · f4fb688c-4412-4426-b4b8-421ecf27b14a (Secondary) |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-j8vm-7q52-2m2m — TYPO3 CSV download feature information disclosure
European references
- ENISA EUVD · EUVD-2025-27226
- GCVE · GCVE-0-2025-59019
Affected configurations (NVD CPE)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.5.48cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 12.0.0 < 12.4.37cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 13.0.0 < 13.4.18
Affected products
| Product | Versions |
|---|---|
| TYPO3 · TYPO3 CMS | affected 12.0.0 < 12.4.37 ; affected 13.0.0 < 13.4.18 |
| TYPO3 · TYPO3 CMS | affected 11.0.0 < 11.5.48 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |