{"id":"GHSA-c22j-84c7-cm77","aliases":["CVE-2009-0815"],"title":"TYPO3 leaks a hash secret in an error message","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.","severity":"medium","score":6.9,"published":"2022-05-02T03:18:36.000Z","modified":"2025-04-10T01:42:10.459Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-c22j-84c7-cm77","url":"https://osv.dev/vulnerability/GHSA-c22j-84c7-cm77"}],"ranges":[{"events":[{"introduced":"3.3"},{"fixed":"4.0.12"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.0.12"]},{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-c22j-84c7-cm77","url":"https://osv.dev/vulnerability/GHSA-c22j-84c7-cm77"}],"ranges":[{"events":[{"introduced":"4.1"},{"fixed":"4.1.10"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.1.10"]},{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-c22j-84c7-cm77","url":"https://osv.dev/vulnerability/GHSA-c22j-84c7-cm77"}],"ranges":[{"events":[{"introduced":"4.2"},{"fixed":"4.2.6"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.2.6"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2009-0815","https://github.com/TYPO3/typo3","https://web.archive.org/web/20091206080208/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002","https://web.archive.org/web/20200915000000*/http://www.securitytracker.com/id?1021710","http://www.debian.org/security/2009/dsa-1720","http://www.openwall.com/lists/oss-security/2009/02/10/6"],"sources":[{"name":"OSV","id":"GHSA-c22j-84c7-cm77","modified":"2025-04-10T01:42:10.459503Z","url":"https://osv.dev/vulnerability/GHSA-c22j-84c7-cm77"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:45:31.656Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"8038","url":"https://www.exploit-db.com/exploits/8038","checkedAt":"2026-10-29T00:00:35.338Z"}]}