PT-2015-5567 · Typo3 · Rsaauth+1

Salvatore Bonaccorso · Published 2015-02-21 · Updated 2016-11-30 · CVE-2015-2047

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.3.0 through 4.3.14 TYPO3 versions 4.4.0 through 4.4.15 TYPO3 versions 4.5.0 through 4.5.39 TYPO3 versions 4.6.0 through 4.6.18

Description The issue allows remote attackers to bypass authentication via a password that is casted to an empty value when the rsaauth extension is configured for the frontend.

Recommendations For versions 4.3.0 through 4.3.14, consider disabling the rsaauth extension for the frontend until a fix is available. For versions 4.4.0 through 4.4.15, consider disabling the rsaauth extension for the frontend until a fix is available. For versions 4.5.0 through 4.5.39, consider disabling the rsaauth extension for the frontend until a fix is available. For versions 4.6.0 through 4.6.18, consider disabling the rsaauth extension for the frontend until a fix is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2015-2047

DSA-3164-1

Affected Products

Typo3

Rsaauth

References · 15

• https://osv.dev/vulnerability/DSA-3164-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2047 · Security Note
• https://security-tracker.debian.org/tracker/source-package/typo3-src · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2047 · Security Note
• http://debian.org/security/2015/dsa-3164 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html · Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-001 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3164-1 · Vendor Advisory
• http://securitytracker.com/id/1031824 · Note
• https://review.typo3.org/#/c/37013 · Note
• http://openwall.com/lists/oss-security/2015/02/22/4 · Note
• http://securityfocus.com/bid/72763 · Note
• http://openwall.com/lists/oss-security/2015/02/22/8 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2047 · Note
• https://packages.debian.org/src:typo3-src · Note