CVE-2015-2047: Low severity typo3 vulnerability
Published Feb 23, 2015
·Updated
The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows remote attackers to bypass authentication via a password that is casted to an empty value.
Affected Software
92 affected components
Typo3 TYPO3=4.3.0
Typo3 TYPO3=4.3.1
Typo3 TYPO3=4.3.2
Typo3 TYPO3=4.3.3
Typo3 TYPO3=4.3.4
Typo3 TYPO3=4.3.5
Typo3 TYPO3=4.3.6
Typo3 TYPO3=4.3.7
Typo3 TYPO3=4.3.8
Typo3 TYPO3=4.3.9
Typo3 TYPO3=4.3.10
Typo3 TYPO3=4.3.11
Typo3 TYPO3=4.3.12
Typo3 TYPO3=4.3.13
Typo3 TYPO3=4.3.14
Typo3 TYPO3=4.4.0
Typo3 TYPO3=4.4.1
Typo3 TYPO3=4.4.2
Typo3 TYPO3=4.4.3
Typo3 TYPO3=4.4.4
Typo3 TYPO3=4.4.5
Typo3 TYPO3=4.4.6
Typo3 TYPO3=4.4.7
Typo3 TYPO3=4.4.8
Typo3 TYPO3=4.4.9
Typo3 TYPO3=4.4.10
Typo3 TYPO3=4.4.11
Typo3 TYPO3=4.4.12
Typo3 TYPO3=4.4.13
Typo3 TYPO3=4.4.14
Typo3 TYPO3=4.4.15
Typo3 TYPO3=4.5.0
Typo3 TYPO3=4.5.1
Typo3 TYPO3=4.5.2
Typo3 TYPO3=4.5.3
Typo3 TYPO3=4.5.4
Typo3 TYPO3=4.5.5
Typo3 TYPO3=4.5.6
Typo3 TYPO3=4.5.7
Typo3 TYPO3=4.5.8
Typo3 TYPO3=4.5.9
Typo3 TYPO3=4.5.10
Typo3 TYPO3=4.5.11
Typo3 TYPO3=4.5.12
Typo3 TYPO3=4.5.13
Typo3 TYPO3=4.5.14
Typo3 TYPO3=4.5.15
Typo3 TYPO3=4.5.16
Typo3 TYPO3=4.5.17
Typo3 TYPO3=4.5.18
Typo3 TYPO3=4.5.19
Typo3 TYPO3=4.5.20
Typo3 TYPO3=4.5.21
Typo3 TYPO3=4.5.22
Typo3 TYPO3=4.5.23
Typo3 TYPO3=4.5.24
Typo3 TYPO3=4.5.25
Typo3 TYPO3=4.5.26
Typo3 TYPO3=4.5.27
Typo3 TYPO3=4.5.28
Typo3 TYPO3=4.5.29
Typo3 TYPO3=4.5.30
Typo3 TYPO3=4.5.31
Typo3 TYPO3=4.5.32
Typo3 TYPO3=4.5.33
Typo3 TYPO3=4.5.34
Typo3 TYPO3=4.5.35
Typo3 TYPO3=4.5.36
Typo3 TYPO3=4.5.37
Typo3 TYPO3=4.5.38
Typo3 TYPO3=4.5.39
Typo3 TYPO3=4.6
Typo3 TYPO3=4.6.0
Typo3 TYPO3=4.6.1
Typo3 TYPO3=4.6.2
Typo3 TYPO3=4.6.3
Typo3 TYPO3=4.6.4
Typo3 TYPO3=4.6.5
Typo3 TYPO3=4.6.6
Typo3 TYPO3=4.6.7
Typo3 TYPO3=4.6.8
Typo3 TYPO3=4.6.9
Typo3 TYPO3=4.6.10
Typo3 TYPO3=4.6.11
Typo3 TYPO3=4.6.12
Typo3 TYPO3=4.6.13
Typo3 TYPO3=4.6.14
Typo3 TYPO3=4.6.15
Typo3 TYPO3=4.6.16
Typo3 TYPO3=4.6.17
Typo3 TYPO3=4.6.18
Debian Debian Linux=7.0
Event History
Feb 23, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2047?
CVE-2015-2047 has a medium severity rating due to its potential to allow unauthorized access to the TYPO3 frontend.
2
How do I fix CVE-2015-2047?
To fix CVE-2015-2047, upgrade TYPO3 to version 4.3.15, 4.4.16, 4.5.40, or a newer version.
3
Which versions of TYPO3 are affected by CVE-2015-2047?
CVE-2015-2047 affects TYPO3 versions 4.3.0 to 4.3.14, 4.4.0 to 4.4.15, 4.5.0 to 4.5.39, and 4.6.0 to 4.6.18.
4
Can CVE-2015-2047 be exploited remotely?
Yes, CVE-2015-2047 can be exploited by remote attackers to bypass authentication.
5
What types of attacks does CVE-2015-2047 enable?
CVE-2015-2047 enables attackers to bypass authentication mechanisms on TYPO3 installations.