CVE-2020-11063 — Observable Response Discrepancy in CMS

CWE-204 — Observable Response DiscrepancyCWE-203 — Observable Discrepancy4 documents4 sources
Severity
3.7LOWNVD
EPSS
0.3%
top 47.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Typo3 CMSTypo3 Cms-coreTypo3 CMS+1 more
Timeline
PublishedMay 13

Description

In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages4 packages

▶Packagisttypo3/cms10.0.0 — 10.4.2
▶Packagisttypo3/cms-core10.0.0 — 10.4.2
▶NVDtypo3/typo310.4.0, 10.4.1+1
▶CVEListV5typo3/typo3_cms>= 10.4.0, <= 10.4.1

🔴Vulnerability Details

3
GHSA
Information Disclosure in Password Reset↗2020-05-13
▶
OSV
Information Disclosure in Password Reset↗2020-05-13
▶
CVEList
Observable Response Discrepancy in TYPO3 CMS↗2020-05-13
▶
CVE-2020-11063 — Observable Response Discrepancy in CMS | cvebase