Skip to content

Information Disclosure in typo3/cms-install tool

Low severity GitHub Reviewed Published Nov 14, 2023 in TYPO3/typo3 • Updated Nov 14, 2023

Package

composer typo3/cms-install (Composer)

Affected versions

>= 12.2.0, < 12.4.8

Patched versions

12.4.8

Description

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C (3.5)

Problem

The login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected.

Solution

Update to TYPO3 version 12.4.8 that fixes the problem described above.

Credits

Thanks to Markus Klein who reported and fixed the issue.

References

References

@ohader ohader published to TYPO3/typo3 Nov 14, 2023
Published by the National Vulnerability Database Nov 14, 2023
Published to the GitHub Advisory Database Nov 14, 2023
Reviewed Nov 14, 2023
Last updated Nov 14, 2023

Severity

Low
3.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CVE ID

CVE-2023-47126

GHSA ID

GHSA-p2jh-95jg-2w55

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.