PT-2023-26479 · Typo3 · Typo3

Garvin Hicking · Published 2023-07-25 · Updated 2024-03-06 · CVE-2023-38499

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 9.4.0 through 9.5.41 ELTS TYPO3 versions 10.4.0 through 10.4.38 ELTS TYPO3 versions 11.5.0 through 11.5.29 TYPO3 versions 12.4.0 through 12.4.3

Description In multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available.

Recommendations Update to TYPO3 version 9.5.42 ELTS to fix the problem. Update to TYPO3 version 10.4.39 ELTS to fix the problem. Update to TYPO3 version 11.5.30 to fix the problem. Update to TYPO3 version 12.4.4 to fix the problem. As a temporary workaround, consider disabling the resolution of sites by the id and L HTTP query parameters until a patch is available. Note that the new feature flag security.frontend.allowInsecureSiteResolutionByQueryParameters can be used to reactivate the previous behavior, but it is disabled per default.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-TYPO3-2023-38499

CVE-2023-38499

GHSA-JQ6G-4V5M-WM9R

Affected Products

Typo3

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38499.json · Exploit
• https://github.com/TYPO3/typo3/commit/702e2debd4b28f9cdb540544565fe6a8627ccb6a · Patch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-jq6g-4v5m-wm9r · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2023-003 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jq6g-4v5m-wm9r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38499 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2023-38499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38499 · Security Note
• https://github.com/TYPO3/typo3 · Note
• https://t.me/cibsecurity/67258 · Telegram Post