GHSA-pqfv-97hj-g97gmedium5.3No CVE assigned
TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure
Impact
It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
typo3/cms Packagist
| Affected range | Recorded fix |
|---|---|
| From 6.2.0 before 6.2.15Ecosystem versions | 6.2.15 |
| From 7.0.0 before 7.4.0Ecosystem versions | 7.4.0 |
Version evidence: OSV · GHSA-pqfv-97hj-g97g
View original version evidence (23 explicit versions)
Original source description
It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation.
References
- Patch github.com/TYPO3/typo3/commit/ed1e46f89c8e5f699ced245e873d0eff21e5c75e
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-09-08-1.yaml
- Source reference github.com/TYPO3/typo3
- Security advisory typo3.org/security/advisory/typo3-core-sa-2015-008
- Security advisory typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-008