Insecure Deserialization in Backend User Settings in TYPO3 CMS

高 8.8CVE-2020-11067 · BIT-typo3-2020-11067 · GHSA-2wj9-434x-9hvp · 14/05/2020 公開 · 17/06/2026 更新

要点

CVE-2020-11067 は typo3/cms, typo3/cms-core, typo3 (typo3) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.0%（全脆弱性の 80.6% より高い）。
対処：10.4.2, 9.5.17 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
typo3/cms Packagist	`≥ 10.0.0, < 10.4.2≥ 9.0.0, < 9.5.17`	`10.4.29.5.17`
typo3/cms-core Packagist	`≥ 10.0.0, < 10.4.2≥ 9.0.0, < 9.5.17`	`10.4.29.5.17`
typo3 typo3	`≥ 10.0.0, ≤ 10.4.1≥ 9.0.0, ≤ 9.5.16`	修正版なし

概要

It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

References

https://typo3.org/security/advisory/typo3-core-sa-2020-005

NVD の説明

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.