CVE-2022-24979

Katalog CVE

CVSS 5.3 · Medium EPSS 0,76%

Kerentanan Authorization Bypass Through User-Controlled Key pada mittwald varnishcache. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer component does not include an access check. This allows an unauthenticated user to render various content elements, resulting in insecure direct object reference (IDOR), with the potential of exposing internal content elements.

Rincian

Terbit di NVD

19 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://typo3.org/help/security-advisories advisory vendor
• https://typo3.org/security/advisory/typo3-ext-sa-2022-003 patch · advisory vendor