CVE-2012-3529: Typo3 Backend Configuration XSS Vulnerability
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.
Other sources
Typo3 Backend Configuration XSS Vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.7.4 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.6.12 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.5.19 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 4.5.19 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 4.6.12 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 4.7.4
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3529?
The severity of CVE-2012-3529 is considered high due to the risk of exposing sensitive encryption keys to remote authenticated users.
How do I fix CVE-2012-3529?
To fix CVE-2012-3529, update TYPO3 to version 4.5.19, 4.6.12, or 4.7.4 or later.
Which versions of TYPO3 are affected by CVE-2012-3529?
CVE-2012-3529 affects TYPO3 versions 4.5.x prior to 4.5.19, 4.6.x prior to 4.6.12, and 4.7.x prior to 4.7.4.
What type of vulnerability is CVE-2012-3529?
CVE-2012-3529 is a security vulnerability that allows unauthorized exposure of encryption keys.
Can CVE-2012-3529 be exploited remotely?
Yes, CVE-2012-3529 can be exploited by remote authenticated backend users.