PT-2020-12527 · Typo3 · Typo3/Cms

Oliver Hader · Published 2020-05-13 · Updated 2024-03-06 · CVE-2020-11066

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 9.0.0 through 9.5.16 TYPO3 CMS versions 10.0.0 through 10.4.1

Description The issue arises when unserialize() is called on malicious user-submitted content, potentially leading to the modification of dynamically-determined object attributes. This can result in the deletion of an arbitrary directory in the file system if it is writable for the web server, or trigger message submission via email using the identity of the web site (mail relay). Another insecure deserialization vulnerability is required to actually exploit these aspects.

Recommendations For TYPO3 CMS versions 9.0.0 through 9.5.16, update to version 9.5.17. For TYPO3 CMS versions 10.0.0 through 10.4.1, update to version 10.4.2.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

BIT-TYPO3-2020-11066

CVE-2020-11066

GHSA-2RXH-H6H9-QRQC

Affected Products

Typo3/Cms

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11066.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11066.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-2rxh-h6h9-qrqc · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2020-11066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11066 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11066 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-2rxh-h6h9-qrqc · Note
• https://t.me/cvenotify/3775 · Telegram Post
• https://typo3.org/security/advisory/typo3-core-sa-2020-004 · Note