CVE-2020-11067: In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure…

PriorityP353high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.99%

78.2th percentile

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
typo3	cms	>= 10.0.0 < 10.4.2	10.4.2
typo3	cms	>= 9.0.0 < 9.5.17	9.5.17
typo3	cms-core	>= 10.0.0 < 10.4.2	10.4.2
typo3	cms-core	>= 9.0.0 < 9.5.17	9.5.17
typo3	typo3	10.0.0 – 10.4.1	—
typo3	typo3	9.0.0 – 9.5.16	—
typo3	typo3_cms	—	—
typo3	typo3_cms	—	—

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.