SB2020072811 - Multiple vulnerabilities in TYPO3

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020072811

SB2020072811 - Multiple vulnerabilities in TYPO3

Published: July 28, 2020

Security Bulletin ID SB2020072811
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 67% Medium 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-15098)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions within the internal verification mechanism in the Backend User Interface subcomponent, which leads to security restrictions bypass and privilege escalation.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-15099)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the eID API subcomponent, which leads to security restrictions bypass and privilege escalation.


3) Improper access control (CVE-ID: CVE-2016-5091)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in Extbase request handling. A remote attacker can send a specially crafted request, bypass implemented security restrictions and execute arbitrary Extbase actions.


Remediation

Install update from vendor's website.

References