| Package | Affected versions | Patched versions |
|---|---|---|
| typo3/cms | ≥ 10.0.0, < 10.4.33≥ 11.0.0, < 11.5.20≥ 12.0.0, < 12.1.1 | 10.4.3311.5.2012.1.1 |
| typo3/cms-core | ≥ 10.0.0, < 10.4.33≥ 11.0.0, < 11.5.20≥ 12.0.0, < 12.1.1≥ 9.0.0, < 9.5.38< 8.7.49 | 10.4.3311.5.2012.1.19.5.388.7.49 |
| typo3 | ≥ 10.0.0, < 10.4.33≥ 11.0.0, < 11.5.20≥ 12.0.0, < 12.1.1≥ 9.0.0, < 9.5.38< 8.7.49 | 10.4.3311.5.2012.1.19.5.388.7.49 |
Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary.
Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free