Information disclosure in TYPO3 - #VU8163
Published: September 7, 2017
Vulnerability identifier: #VU8163
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to insufficient validation of user-supplied data. A remote attacker can send a specially crafted HTTP request to the TYPO3 API, trick the victim into opening it and view potentially sensitive version information on the target system.
The weakness exists due to insufficient validation of user-supplied data. A remote attacker can send a specially crafted HTTP request to the TYPO3 API, trick the victim into opening it and view potentially sensitive version information on the target system.
Affected software
TYPO3
Remediation
Update to version 7.6.22 or 8.7.5.