PT-2020-17053 · Typo3 · Ext:Felogin+2

Thomas Deuling · Published 2020-11-18 · Updated 2020-12-02 · CVE-2020-28917

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions view statistics extension versions prior to 2.0.1 for TYPO3

Description An issue in the view statistics extension saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data, such as cleartext passwords if ext:felogin is installed, may be saved.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider disabling the view statistics extension until a patch is available. Restrict access to sensitive data and consider removing any saved sensitive information from the database.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-28917

Affected Products

Typo3

Ext:Felogin

View Statistics

References · 5

• https://typo3.org/security/advisory/typo3-ext-sa-2020-019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28917 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28917 · Vendor Advisory
• https://t.me/cibsecurity/16494 · Telegram Post
• https://t.me/cvenotify/5757 · Telegram Post