Low severity3.7NVD Advisory· Published May 13, 2020· Updated Jun 17, 2026
CVE-2020-11063
CVE-2020-11063
Description
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cms-corePackagist | >= 10.0.0, < 10.4.2 | 10.4.2 |
typo3/cmsPackagist | >= 10.0.0, < 10.4.2 | 10.4.2 |
Affected products
6- ghsa-coords3 versions
>= 10.0.0, < 10.4.2+ 2 more
- (no CPE)range: >= 10.0.0, < 10.4.2
- (no CPE)range: >= 10.0.0, < 10.4.2
- (no CPE)range: >= 10.4.0, <= 10.4.0
Patches
Vulnerability mechanics
References
8- github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwxnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-347x-877p-hcwxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-11063ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yamlghsaWEB
- github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574nvdWEB
- github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwxnvdWEB
- typo3.org/security/advisory/typo3-core-sa-2020-001ghsaWEB
News mentions
0No linked articles in our index yet.