Information Disclosure in Workspaces Module (TYPO3 TYPO3 CMS)
En bref
- Source
- NVD
- EPSS
- EPSS 0.29 % · centile 22 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- TYPO3
- Statut NVD
- Analyzed
Rechercher sur…
Description
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | TYPO3 |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · f4fb688c-4412-4426-b4b8-421ecf27b14a (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-w2pf-7q5w-2cgw — TYPO3 Workspaces Module Information Disclosure
Références européennes
- ENISA EUVD · EUVD-2025-27227
- GCVE · GCVE-0-2025-59018
Configurations affectées (CPE NVD)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.5.55cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.4.54cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.5.48cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 12.0.0 < 12.4.37cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 13.0.0 < 13.4.18
Produits affectés
| Produit | Versions |
|---|---|
| TYPO3 · TYPO3 CMS | affected 9.0.0 < 9.5.55 ; affected 10.0.0 < 10.4.54 ; affected 11.0.0 < 11.5.48 ; affected 12.0.0 < 12.4.37 ; affected 13.0.0 < 13.4.18 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |