CVE-2010-0286 Auth bypass in n/a
Remote attackers can bypass authentication to access backend accounts in TYPO3 when using OpenID providers that discard identities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2010-0286?
CVE-2010-0286 is a medium-severity authentication bypass vulnerability in Typo3 Typo3, published on 21 Feb 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities during authentication.
Which versions are affected by CVE-2010-0286?
It affects 1 product.
Products include Typo3 Typo3.
How do I fix CVE-2010-0286?
No fix has been published for CVE-2010-0286 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2010-0286 being exploited?
There is no known exploitation of CVE-2010-0286 in the wild and no public exploit code.
Other vulnerabilities in Typo3 Typo3
- CVE-2009-0258 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
- CVE-2011-3583 Typo3 SQL injection due to faulty prepared statements
- CVE-2011-4628 Typo3 Authentication Bypass
- CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3
- CVE-2021-41113 Cross-Site-Request-Forgery in Backend URI Handling in Typo3
Sources
Also known as GHSA-xv92-wq9x-wgm4.