CVE-2020-15098

moderate-risk
Published 2020-07-29

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.

Do I need to act?

~
2.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Typo3

References (8)

Broken Link https://github.com/TYPO3/TYPO3.CMS/commit/85d3e70dff35a99ef53f4b561114acfa9e5c47...
Third Party Advisory https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxp
Vendor Advisory https://typo3.org/security/advisory/typo3-core-sa-2016-013
Vendor Advisory https://typo3.org/security/advisory/typo3-core-sa-2020-008
Broken Link https://github.com/TYPO3/TYPO3.CMS/commit/85d3e70dff35a99ef53f4b561114acfa9e5c47...
Third Party Advisory https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxp
Vendor Advisory https://typo3.org/security/advisory/typo3-core-sa-2016-013
Vendor Advisory https://typo3.org/security/advisory/typo3-core-sa-2020-008
40
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 5/34 · Minimal
Exposure 5/34 · Minimal