Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
TYPO3 Leaks Information about Installed Extensions
published 2 years ago
Summary
A security issue in TYPO3 can reveal details about installed extensions, including third-party ones. This could potentially allow an attacker to gather sensitive information about your system. To protect your site, update to the latest version of TYPO3 to fix this issue.
What to do
- Update typo3 cms-core to version 8.7.23.
- Update typo3 cms-core to version 9.5.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | typo3 | cms-core |
>= 8.0.0, < 8.7.23 >= 9.0.0, < 9.5.4 Fix: upgrade to 8.7.23
|
Original advisory text
TYPO3 Disclosure of Information about Installed Extensions
It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.
References
- https://github.com/TYPO3-CMS/core/commit/7960334bba1223a681283158f67a999334e88cf...
- https://github.com/TYPO3-CMS/core/commit/9453d8a8763fffa76deb6a16f6b99c0ab6f3d8f...
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2...
- https://typo3.org/security/advisory/typo3-core-sa-2019-001
- https://github.com/advisories/GHSA-p2h4-7fp3-cmh8
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published30 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-p2h4-7fp3-cmh8 · GHSA
Track software like this
Free during beta