CVE-2009-0816: XSS
An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host.
The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing them to bypass access control by providing the correct value.
There's no authentication required to exploit this vulnerability. The vulnerability allows to read any file, the web server user account has access to.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.1.10 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0816?
CVE-2009-0816 is classified as an information disclosure vulnerability, which can lead to unauthorized file access.
How do I fix CVE-2009-0816?
To fix CVE-2009-0816, you should upgrade to the latest version of TYPO3, specifically version 4.2.6 or newer.
Which TYPO3 versions are affected by CVE-2009-0816?
CVE-2009-0816 affects TYPO3 versions from 3.3.0 up to 4.2.5.
Can CVE-2009-0816 allow attackers to access sensitive files?
Yes, CVE-2009-0816 can enable attackers to read arbitrary files from the host server.
What is the jumpUrl vulnerability in CVE-2009-0816?
The jumpUrl vulnerability in CVE-2009-0816 allows remote attackers to exploit the mishandling of mandatory hash secrets, exposing files.