CVE-2010-3664

Vulnerability

Description CVE-2010-3664 is an information disclosure vulnerability in the TYPO3 backend. Versions prior to 4.1.14, 4.2.13, 4.3.4, and 4.4.1 fail to properly sanitize user input, leading to the exposure of sensitive information [1][2]. This issue is part of a larger set of vulnerabilities addressed in the TYPO3 Security Advisory TYPO3-SA-2010-012 [1].

Exploitation

Exploitation requires a valid backend login, as the vulnerability exists within the authenticated backend interface [1]. The attack complexity is considered low, as the disclosure can be triggered through crafted requests that exploit unsanitized input fields [1]. No special network position is required beyond HTTP access to the backend.

Impact

An authenticated attacker can leverage this flaw to retrieve sensitive data that would otherwise be restricted [2]. While the exact disclosed information is not specified in the advisory, the vulnerability is classified as 'Information Disclosure' and could expose internal configuration details or user data [1][2]. The CVSS v2.0 score, though not officially assigned, suggests a partial impact on confidentiality [1].

Mitigation

The vulnerability is fixed in TYPO3 versions 4.1.14, 4.2.13, 4.3.4, and 4.4.1 [1]. Users of affected versions should upgrade immediately. The Debian security tracker also references this CVE and confirms the fix via DSA-2098-1 [4]. No workarounds are documented, and the vendor considers the risk high, recommending patching as the only solution [1].