CVE-2023-38499

Katalog CVE

CVSS 5.3 · Medium EPSS 1,1%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada typo3. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.

Rincian

Terbit di NVD

25 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/TYPO3/typo3/security/advisories/GHSA-jq6g-4v5m-wm9r advisory vendor
• https://typo3.org/security/advisory/typo3-core-sa-2023-003 advisory vendor
• https://github.com/TYPO3/typo3/commit/702e2debd4b28f9cdb540544565fe6a8627ccb6a patch