GHSA-87hc-phmj-rhgh

ghsaUSosv

TYPO3 Information Disclosure Vulnerability

view advisory published 2022-05-13Licence: CC-BY-4.0

TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-6370US	medium5.3OT elevated	0.99% (62nd)	Exploit	2017-03-17
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by snif…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/97071WEB
https://github.com/TYPO3/typo3PACKAGE
https://github.com/faizzaidi/TYPO3-v7.6.15-Unencrypted-Login-RequestWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-6370ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan