GHSA-6487-3qvg-8px9medium5.3No CVE assigned
TYPO3 Information Disclosure in Install Tool
Impact
The Install Tool exposes the current TYPO3 version number to non-authenticated users.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
typo3/cms Packagist
| Affected range | Recorded fix |
|---|---|
| From 7.0.0 before 7.6.32Ecosystem versions | 7.6.32 |
| From 8.0.0 before 8.7.21Ecosystem versions | 8.7.21 |
| From 9.0.0 before 9.5.2Ecosystem versions | 9.5.2 |
Version evidence: OSV · GHSA-6487-3qvg-8px9
View original version evidence (88 explicit versions)
Original source description
The Install Tool exposes the current TYPO3 version number to non-authenticated users.
References
- Patch github.com/TYPO3/typo3/commit/232d0a64282382229c205904173a16a581555fe3
- Patch github.com/TYPO3/typo3/commit/b4dd20f31d483f6399e8bcbffcac3e16a2df0d92
- Patch github.com/TYPO3/typo3/commit/fab0cbc970b709ed65fc4622a2cbd52a197480c4
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-5.yaml
- Source reference github.com/TYPO3/typo3
- Security advisory typo3.org/security/advisory/typo3-core-sa-2018-010