CVE-2010-3666: TYPO3 is vulnerable to Insecure randomness in uniqid function
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function.
Other sources
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function.
TYPO3 is vulnerable to Insecure randomness in uniqid function
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-installto a version that resolves this vulnerability.Fixed in 4.4.1 - Upgrade
Upgrade
composer/typo3/cms-installto a version that resolves this vulnerability.Fixed in 4.3.4 - Upgrade
Upgrade
composer/typo3/cms-installto a version that resolves this vulnerability.Fixed in 4.2.13 - Upgrade
Upgrade
composer/typo3/cms-installto a version that resolves this vulnerability.Fixed in 4.1.14
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3666?
CVE-2010-3666 has a medium severity level due to the insecure randomness in the uniqid function.
How do I fix CVE-2010-3666?
To mitigate CVE-2010-3666, upgrade TYPO3 to version 4.4.1, 4.3.4, 4.2.13, or 4.1.14.
What versions of TYPO3 are affected by CVE-2010-3666?
CVE-2010-3666 affects TYPO3 versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1.
Is CVE-2010-3666 related to randomness?
Yes, CVE-2010-3666 is specifically related to the insecure randomness in the uniqid function used in TYPO3.
What should I do if I can't upgrade due to compatibility issues with CVE-2010-3666?
If upgrading is not possible, consider applying security best practices for web applications and monitoring for vulnerabilities.