CVE-2020-11063

Katalog CVE

CVSS 3.7 · Low EPSS 1,2%

Kerentanan Observable Response Discrepancy pada typo3. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.

Rincian

Terbit di NVD

13 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy
CWE-203: Observable Discrepancy

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx advisory pihak ketiga
• https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574
• https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx