PT-2017-17023 · Typo3 · Typo3

Publicado 2017-03-17 · Atualizado 2022-05-13 · CVE-2017-6370

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 version 7.6.15

Description The issue allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields. This occurs when TYPO3 sends an HTTP request to an "index.php?loginProvider" URI in cases with an HTTPS Referer.

Recommendations For TYPO3 version 7.6.15, consider updating to a newer version that addresses this issue, as sending sensitive information over HTTP can be exploited by sniffing the network. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2017-6370

GHSA-87HC-PHMJ-RHGH

Produtos afetados

Typo3

Referências · 6

• 🔥 https://github.com/faizzaidi/TYPO3-v7.6.15-Unencrypted-Login-Request · Exploit
• https://github.com/TYPO3/typo3 · Nota
• https://osv.dev/vulnerability/GHSA-87hc-phmj-rhgh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6370 · Aviso do Fabricante
• http://securityfocus.com/bid/97071 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6370 · Nota de Segurança