PT-2020-12529 · Typo3 · Typo3/Cms

Matteo Bonaker · Published 2020-05-13 · Updated 2024-03-06 · CVE-2020-11069

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 9.0.0 through 9.5.16 TYPO3 CMS versions 10.0.0 through 10.4.1

Description A same-site request forgery vulnerability has been discovered in the backend user interface and install tool of TYPO3 CMS. This vulnerability can be triggered by a cross-site scripting vulnerability, allowing an attacker to trick a backend user into interacting with a malicious resource. The attacker can then execute scripts with the privileges of the victim's user session, potentially creating new admin users. The vulnerability requires an active and valid backend or install tool user session to be successful. Malicious payload, such as HTML containing JavaScript, can be provided by either an authenticated backend user or a non-authenticated user using a third-party extension.

Recommendations Update to TYPO3 version 9.5.17 to mitigate the issue. Update to TYPO3 version 10.4.2 to mitigate the issue. Consider deploying additional mitigation techniques, such as the Sudo Mode Extension, which intercepts modifications to security-relevant database tables and requires confirmation from the acting user. Implement a Content Security Policy to disallow script executions for specific locations, such as /fileadmin/ and /uploads/.

Exploit

Fix

Origin Validation Error

CSRF

Weakness Enumeration

CWE-346

CWE-309

CWE-352

Related Identifiers

BIT-TYPO3-2020-11069

CVE-2020-11069

GHSA-657M-V5VM-F6RW

GHSA-PQG8-CRX9-G8M4

Affected Products

Typo3/Cms

References · 19

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41113.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41113.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11069.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11069.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-657m-v5vm-f6rw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pqg8-crx9-g8m4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11069 · Security Note
• https://osv.dev/vulnerability/BIT-typo3-2020-11069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41113 · Security Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw · Note
• https://github.com/TYPO3/typo3/commit/fa51999203c5e5d913ecae5ea843ccb2b95fa33f · Note
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-pqg8-crx9-g8m4 · Note
• https://github.com/FriendsOfTYPO3/sudo-mode · Note