CVE-2023-38499
LOW3.7EPSS 2.2%Information Disclosure due to Out-of-scope Site Resolution
發布日:2023/7/25修改日:2024/3/6
描述
TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.
受影響套件(2)
- Bitnami/typo3>= 9.4.0, < 9.5.42, >= 10.0.0, < 10.4.39, >= 11.0.0, < 11.5.30, >= 12.0.0, < 12.4.4
- Packagist/typo3/cms-core>= 9.4.0, < 9.5.42
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
參考連結(5)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-38499
- PATCHhttps://github.com/TYPO3/typo3
- WEBhttps://github.com/TYPO3/typo3/commit/702e2debd4b28f9cdb540544565fe6a8627ccb6a
- WEBhttps://github.com/TYPO3/typo3/security/advisories/GHSA-jq6g-4v5m-wm9r
- WEBhttps://typo3.org/security/advisory/typo3-core-sa-2023-003