PT-2020-16357 · Typo3 · Typo3

Helmut Hummel · Published 2020-11-23 · Updated 2024-03-06 · CVE-2020-26228

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 9.5.23 TYPO3 versions prior to 10.4.10

Description The issue concerns user session identifiers being stored in cleartext without additional cryptographic hashing algorithms. This cannot be exploited directly and occurs in combination with a chained attack, such as SQL injection in another system component.

Recommendations Update to TYPO3 version 9.5.23 to resolve the issue. Update to TYPO3 version 10.4.10 to resolve the issue.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BIT-TYPO3-2020-26228

CVE-2020-26228

GHSA-954J-F27R-CJ52

Affected Products

Typo3

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-26228.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-26228.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26228 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2020-011 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26228 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-954j-f27r-cj52 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2020-26228 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-954j-f27r-cj52 · Note
• https://t.me/cibsecurity/16755 · Telegram Post
• https://t.me/cvenotify/6407 · Telegram Post