Low severityNVD Advisory· Published May 13, 2020· Updated Dec 3, 2024
Observable Response Discrepancy in TYPO3 CMS
CVE-2020-11063
Description
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cms-corePackagist | >= 10.0.0, < 10.4.2 | 10.4.2 |
typo3/cmsPackagist | >= 10.0.0, < 10.4.2 | 10.4.2 |
Affected products
4- osv-coords3 versions
>= 10.4.0, <= 10.4.0+ 2 more
- (no CPE)range: >= 10.4.0, <= 10.4.0
- (no CPE)range: >= 10.0.0, < 10.4.2
- (no CPE)range: >= 10.0.0, < 10.4.2
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-347x-877p-hcwxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-11063ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yamlghsaWEB
- github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwxghsaWEB
- github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574ghsax_refsource_MISCWEB
- github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwxghsax_refsource_CONFIRMWEB
- typo3.org/security/advisory/typo3-core-sa-2020-001ghsaWEB
News mentions
0No linked articles in our index yet.