CVE-2020-11063: Observable Response Discrepancy in TYPO3 CMS
First published: Tue May 12 2020(Updated: )
In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2. ### References * https://typo3.org/security/advisory/typo3-core-sa-2020-001
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms | >=10.0.0<10.4.2 | |
| composer/typo3/cms-core | >=10.0.0<10.4.2 | |
| Typo3 Typo3 | =10.4.0 | |
| Typo3 Typo3 | =10.4.1 | |
| composer/typo3/cms | >=10.0.0<10.4.2 | 10.4.2 |
| composer/typo3/cms-core | >=10.0.0<10.4.2 | 10.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://typo3.org/security/advisory/typo3-core-sa-2020-001
- https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx
- https://nvd.nist.gov/vuln/detail/CVE-2020-11063
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yaml
- https://github.com/advisories/GHSA-347x-877p-hcwx (Advisory)
Frequently Asked Questions
What is CVE-2020-11063?
CVE-2020-11063 is a vulnerability in TYPO3 CMS versions 10.4.0 and 10.4.1 that allows time-based attacks with the password reset functionality, leading to user enumeration based on email addresses.
How does CVE-2020-11063 affect TYPO3 CMS?
CVE-2020-11063 affects TYPO3 CMS versions 10.4.0 and 10.4.1.
What is the severity of CVE-2020-11063?
The severity of CVE-2020-11063 is medium with a CVSS score of 3.7.
How can I fix CVE-2020-11063?
To fix CVE-2020-11063, update TYPO3 CMS to version 10.4.2.
Where can I find more information about CVE-2020-11063?
You can find more information about CVE-2020-11063 in the TYPO3 security advisory (https://typo3.org/security/advisory/typo3-core-sa-2020-001) and the GitHub security advisory (https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx).
- collector/friends-of-php
- collector/nvd-index
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/description
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-347x-877p-hcwx
- alias/CVE-2020-11063
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/tags
- agent/event
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/10.4.0
- version/typo3 typo3/10.4.1