CVE-2010-3661

CVE-2010-3661 describes an open redirection vulnerability in the TYPO3 backend. The issue arises from insufficient sanitization of user input in several backend components, allowing attackers to craft URLs that redirect users to arbitrary external destinations [1].

To exploit this vulnerability, an attacker must have a valid backend login, as the open redirection is present within authenticated areas of the TYPO3 backend. The attacker can then manipulate redirect parameters to point to malicious websites [1].

Successful exploitation could be used for phishing attacks, where victims are redirected to attacker-controlled pages that mimic legitimate TYPO3 interfaces, potentially leading to credential theft or other malicious activities [2].

TYPO3 addressed the vulnerability by releasing versions 4.1.14, 4.2.13, 4.3.4, and 4.4.1. Users are strongly advised to upgrade to these fixed versions to mitigate the risk [1][4].