| Package | Affected versions | Patched versions |
|---|---|---|
| typo3/cms | ≥ 3.3, < 4.0.12≥ 4.1, < 4.1.10≥ 4.2, < 4.2.6 | 4.0.124.1.104.2.6 |
| typo3 | = 3.3.x= 3.5.x= 3.6.x= 3.7.x= 3.8.x= 4.0= 4.1= 4.1.0= 4.1.2= 4.1.3= 4.1.4= 4.1.5= 4.1.6= 4.1.7= 4.1.8= 4.1.9= 4.2= 4.2.0= 4.2.1= 4.2.2= 4.2.3= 4.2.4= 4.2.5= 4.3 |
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free