PT-2019-6574 · Typo3 · Typo3

Helmut Hummel + 1 · Published 2019-11-05 · Updated 2022-04-21 · CVE-2010-3670

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 4.3.4 TYPO3 versions 4.4.x prior to 4.4.1

Description The issue concerns insecure randomness during the generation of a hash with the "forgot password" function.

Recommendations For versions prior to 4.3.4, update to version 4.3.4 or later. For versions 4.4.x prior to 4.4.1, update to version 4.4.1 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2010-3670

DSA-2098-1

GHSA-3276-P9F2-8Q89

Affected Products

Typo3

References · 9

• https://security-tracker.debian.org/tracker/CVE-2010-3670 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-sa-2010-012/#Insecure_Randomness · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3670 · Security Note
• https://osv.dev/vulnerability/GHSA-3276-p9f2-8q89 · Vendor Advisory
• https://github.com/TYPO3/typo3/commit/09ab77653161f23e266470a5984d4d5e64588355 · Note
• https://github.com/TYPO3/typo3/commit/c03e944d200bf427bb18cad15f2ad36bc83061c9 · Note
• https://github.com/TYPO3-CMS/frontend · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3670 · Note