CVE-2023-38499: typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution
> ### CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C (3.5)
Problem In multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available.
Solution Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 that fix the problem described above.
> ℹ️ Strong security defaults - Manual actions required > Resolving sites by the id and L HTTP query parameters is now denied per default. However, it is still allowed to resolve a particular page by e.g. https://example.org/?id=123&L=0 - as long as the page-id 123 is in the scope of the site configured for the base-url example.org. > The new feature flag security.frontend.allowInsecureSiteResolutionByQueryParameters - which is disabled per default - can be used to reactivate the previous behavior.
Credits Thanks to Garvin Hicking who reported this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References TYPO3-CORE-SA-2023-003
Other sources
TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-38499?
CVE-2023-38499 is a vulnerability in the TYPO3 CMS that allows out-of-scope access to rendered content in the website frontend.
What is the severity of CVE-2023-38499?
The severity of CVE-2023-38499 is medium with a CVSS score of 5.3.
How does CVE-2023-38499 affect TYPO3?
CVE-2023-38499 affects TYPO3 versions 9.4.0 to 12.4.4, potentially allowing visitors to access content of an unauthorized website.
How can I fix CVE-2023-38499 in TYPO3?
To fix CVE-2023-38499, update TYPO3 to version 9.5.42, 10.4.39, 11.5.30, or 12.4.4.
Where can I find more information about CVE-2023-38499?
More information about CVE-2023-38499 can be found on the TYPO3 GitHub advisory page and the National Vulnerability Database (NVD) page.