TI-2020-11874 Aliases CVE-2020-15099 GHSA-3x94-fv5h-5q2c

Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

LOW 39CWE-20Published 2020-07-29 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php, which again contains the encryptionKey as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network, this allows the ability to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. This has been patched in versions 9.5.20 and 10.4.6.

Why it matters now

EPSS 0.0179 78th percentileScored 2026-11-07

Fix Fixed TYPO3 CMS (TYPO3): 9.5.20typo3/cms-core (Packagist): 9.5.20, 10.4.6+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TYPO3	TYPO3 CMS	9.0.0 to before 9.5.20; >= 10.0.0, 10.4.6	9.5.20	Patch available	CNA
—	typo3/cms-core (Packagist)	9.0.0 to before 9.5.20	9.5.20	Patch available	GHSA-3x94-fv5h-5q2c
—	typo3/cms-core (Packagist)	10.0.0 to before 10.4.6	10.4.6	Patch available	GHSA-3x94-fv5h-5q2c
—	typo3/cms (Packagist)	10.0.0 to before 10.4.6	10.4.6	Patch available	GHSA-3x94-fv5h-5q2c
—	typo3/cms (Packagist)	9.0.0 to before 9.5.20	9.5.20	Patch available	GHSA-3x94-fv5h-5q2c

TYPO3 CMS VendorTYPO3 Affected 9.0.0 to before 9.5.20; >= 10.0.0, 10.4.6 Fixed in 9.5.20 Patch available CNA
typo3/cms-core (Packagist) Vendor— Affected 9.0.0 to before 9.5.20 Fixed in 9.5.20 Patch available GHSA-3x94-fv5h-5q2c
typo3/cms-core (Packagist) Vendor— Affected 10.0.0 to before 10.4.6 Fixed in 10.4.6 Patch available GHSA-3x94-fv5h-5q2c
typo3/cms (Packagist) Vendor— Affected 10.0.0 to before 10.4.6 Fixed in 10.4.6 Patch available GHSA-3x94-fv5h-5q2c
typo3/cms (Packagist) Vendor— Affected 9.0.0 to before 9.5.20 Fixed in 9.5.20 Patch available GHSA-3x94-fv5h-5q2c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:typo3:typo3::::::::	9.0.0 to before 9.5.20; 10.0.0 to before 10.4.6	Vulnerable	TYPO3

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.5.20; 10.0.0 to before 10.4.6 Vulnerable ·TYPO3

Remediation

Fix · CNA TYPO3 CMS (TYPO3) Fixed in 9.5.20
Fix · GHSA-3x94-fv5h-5q2c typo3/cms-core (Packagist) Fixed in 9.5.20 Advisory →
Fix · GHSA-3x94-fv5h-5q2c typo3/cms-core (Packagist) Fixed in 10.4.6 Advisory →
Fix · GHSA-3x94-fv5h-5q2c typo3/cms (Packagist) Fixed in 10.4.6 Advisory →
Fix · GHSA-3x94-fv5h-5q2c typo3/cms (Packagist) Fixed in 9.5.20 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-15099
2026-10-03 Alias added: GHSA-3x94-fv5h-5q2c

References

Advisory 3

Other 3

TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
TI-2009-00241 The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9… CVSS 2.0HIGH 10.0
TI-2020-08940 Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS CVSS 3.1CRITICAL 10.0
TI-2011-03994 Improper authentication in TYPO3 CVSS 3.1CRITICAL 9.8

See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences