CVE-2020-150988.8HighCWE-325

CVE-2020-15098: Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS

TYPO3 · TYPO3 CMS

Affected: TYPO3 CMS · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

2.2%probability of exploitation in the next 30 days

83rd percentile

050100

Higher than 83% of scored CVEs

8.8HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

TYPO3 · TYPO3 CMS>= 9.0.0, < 9.5.20; >= 10.0.0, 10.4.6

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Missing Cryptographic Step · Cryptography
Vendor: TYPO3
Published: July 2020
Band: Possible (1 to 10%), July 2020

CoverageNo articles yet

No CyberSIXT article names CVE-2020-15098 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.