TYPO3 Allows Information Disclosure via DBAL Restriction Handling
The advisory, in context
Problem
When performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via FrontendGroupRestriction to the last table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users.
Solution
Update to TYPO3 versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described.
Credits
Thanks to Christian Futterlieb for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 9.0.0 before 9.5.51
Fixed in 9.5.51
41 explicitly affected versions
v9.0.0, v9.1.0, v9.2.0, v9.2.1, v9.3.0, v9.3.1, v9.3.2, v9.3.3, v9.4.0, v9.5.0, v9.5.1, v9.5.10, v9.5.11, v9.5.12, v9.5.13, v9.5.14, v9.5.15, v9.5.16, v9.5.17, v9.5.18, v9.5.19, v9.5.2, v9.5.20, v9.5.21, v9.5.22, v9.5.23, v9.5.24, v9.5.25, v9.5.26, v9.5.27, v9.5.28, v9.5.29, v9.5.3, v9.5.30, v9.5.31, v9.5.4, v9.5.5, v9.5.6, v9.5.7, v9.5.8, v9.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.51"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v9.0.0",
"v9.1.0",
"v9.2.0",
"v9.2.1",
"v9.3.0",
"v9.3.1",
"v9.3.2",
"v9.3.3",
"v9.4.0",
"v9.5.0",
"v9.5.1",
"v9.5.10",
"v9.5.11",
"v9.5.12",
"v9.5.13",
"v9.5.14",
"v9.5.15",
"v9.5.16",
"v9.5.17",
"v9.5.18",
"v9.5.19",
"v9.5.2",
"v9.5.20",
"v9.5.21",
"v9.5.22",
"v9.5.23",
"v9.5.24",
"v9.5.25",
"v9.5.26",
"v9.5.27",
"v9.5.28",
"v9.5.29",
"v9.5.3",
"v9.5.30",
"v9.5.31",
"v9.5.4",
"v9.5.5",
"v9.5.6",
"v9.5.7",
"v9.5.8",
"v9.5.9"
]
}From 10.0.0 before 10.4.50
Fixed in 10.4.50
43 explicitly affected versions
v10.0.0, v10.1.0, v10.2.0, v10.2.1, v10.2.2, v10.3.0, v10.4.0, v10.4.1, v10.4.10, v10.4.11, v10.4.12, v10.4.13, v10.4.14, v10.4.15, v10.4.16, v10.4.17, v10.4.18, v10.4.19, v10.4.2, v10.4.20, v10.4.21, v10.4.22, v10.4.23, v10.4.24, v10.4.25, v10.4.26, v10.4.27, v10.4.28, v10.4.29, v10.4.3, v10.4.30, v10.4.31, v10.4.32, v10.4.33, v10.4.34, v10.4.36, v10.4.37, v10.4.4, v10.4.5, v10.4.6, v10.4.7, v10.4.8, v10.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.50"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v10.0.0",
"v10.1.0",
"v10.2.0",
"v10.2.1",
"v10.2.2",
"v10.3.0",
"v10.4.0",
"v10.4.1",
"v10.4.10",
"v10.4.11",
"v10.4.12",
"v10.4.13",
"v10.4.14",
"v10.4.15",
"v10.4.16",
"v10.4.17",
"v10.4.18",
"v10.4.19",
"v10.4.2",
"v10.4.20",
"v10.4.21",
"v10.4.22",
"v10.4.23",
"v10.4.24",
"v10.4.25",
"v10.4.26",
"v10.4.27",
"v10.4.28",
"v10.4.29",
"v10.4.3",
"v10.4.30",
"v10.4.31",
"v10.4.32",
"v10.4.33",
"v10.4.34",
"v10.4.36",
"v10.4.37",
"v10.4.4",
"v10.4.5",
"v10.4.6",
"v10.4.7",
"v10.4.8",
"v10.4.9"
]
}From 11.0.0 before 11.5.44
Fixed in 11.5.44
51 explicitly affected versions
v11.0.0, v11.1.0, v11.1.1, v11.2.0, v11.3.0, v11.3.1, v11.3.2, v11.3.3, v11.4.0, v11.5.0, v11.5.1, v11.5.10, v11.5.11, v11.5.12, v11.5.13, v11.5.14, v11.5.15, v11.5.16, v11.5.17, v11.5.18, v11.5.19, v11.5.2, v11.5.20, v11.5.21, v11.5.22, v11.5.23, v11.5.24, v11.5.25, v11.5.26, v11.5.27, v11.5.28, v11.5.29, v11.5.3, v11.5.30, v11.5.31, v11.5.32, v11.5.33, v11.5.34, v11.5.35, v11.5.36, v11.5.37, v11.5.38, v11.5.39, v11.5.4, v11.5.40, v11.5.41, v11.5.5, v11.5.6, v11.5.7, v11.5.8, v11.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.44"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v11.0.0",
"v11.1.0",
"v11.1.1",
"v11.2.0",
"v11.3.0",
"v11.3.1",
"v11.3.2",
"v11.3.3",
"v11.4.0",
"v11.5.0",
"v11.5.1",
"v11.5.10",
"v11.5.11",
"v11.5.12",
"v11.5.13",
"v11.5.14",
"v11.5.15",
"v11.5.16",
"v11.5.17",
"v11.5.18",
"v11.5.19",
"v11.5.2",
"v11.5.20",
"v11.5.21",
"v11.5.22",
"v11.5.23",
"v11.5.24",
"v11.5.25",
"v11.5.26",
"v11.5.27",
"v11.5.28",
"v11.5.29",
"v11.5.3",
"v11.5.30",
"v11.5.31",
"v11.5.32",
"v11.5.33",
"v11.5.34",
"v11.5.35",
"v11.5.36",
"v11.5.37",
"v11.5.38",
"v11.5.39",
"v11.5.4",
"v11.5.40",
"v11.5.41",
"v11.5.5",
"v11.5.6",
"v11.5.7",
"v11.5.8",
"v11.5.9"
]
}From 12.0.0 before 12.4.31
Fixed in 12.4.31
38 explicitly affected versions
v12.0.0, v12.1.0, v12.1.1, v12.1.2, v12.1.3, v12.2.0, v12.3.0, v12.4.0, v12.4.1, v12.4.10, v12.4.11, v12.4.12, v12.4.13, v12.4.14, v12.4.15, v12.4.16, v12.4.17, v12.4.18, v12.4.19, v12.4.2, v12.4.20, v12.4.21, v12.4.22, v12.4.23, v12.4.24, v12.4.25, v12.4.26, v12.4.27, v12.4.28, v12.4.29, v12.4.3, v12.4.30, v12.4.4, v12.4.5, v12.4.6, v12.4.7, v12.4.8, v12.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.4.31"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v12.0.0",
"v12.1.0",
"v12.1.1",
"v12.1.2",
"v12.1.3",
"v12.2.0",
"v12.3.0",
"v12.4.0",
"v12.4.1",
"v12.4.10",
"v12.4.11",
"v12.4.12",
"v12.4.13",
"v12.4.14",
"v12.4.15",
"v12.4.16",
"v12.4.17",
"v12.4.18",
"v12.4.19",
"v12.4.2",
"v12.4.20",
"v12.4.21",
"v12.4.22",
"v12.4.23",
"v12.4.24",
"v12.4.25",
"v12.4.26",
"v12.4.27",
"v12.4.28",
"v12.4.29",
"v12.4.3",
"v12.4.30",
"v12.4.4",
"v12.4.5",
"v12.4.6",
"v12.4.7",
"v12.4.8",
"v12.4.9"
]
}From 13.0.0 before 13.4.12
Fixed in 13.4.12
20 explicitly affected versions
v13.0.0, v13.0.1, v13.1.0, v13.1.1, v13.2.0, v13.2.1, v13.3.0, v13.3.1, v13.4.0, v13.4.1, v13.4.10, v13.4.11, v13.4.2, v13.4.3, v13.4.4, v13.4.5, v13.4.6, v13.4.7, v13.4.8, v13.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.4.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v13.0.0",
"v13.0.1",
"v13.1.0",
"v13.1.1",
"v13.2.0",
"v13.2.1",
"v13.3.0",
"v13.3.1",
"v13.4.0",
"v13.4.1",
"v13.4.10",
"v13.4.11",
"v13.4.2",
"v13.4.3",
"v13.4.4",
"v13.4.5",
"v13.4.6",
"v13.4.7",
"v13.4.8",
"v13.4.9"
]
}