CVE-2020-11063 Observable Response Discrepancy in TYPO3 CMS
Attackers can enumerate backend user accounts via timing attacks on password reset, exposing valid email addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11063?
CVE-2020-11063 is a low-severity vulnerability in Typo3 Typo3, published on 13 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
Which versions are affected by CVE-2020-11063?
5 open source packages ship an affected version, including typo3/cms, typo3 and typo3/cms-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms Packagist | From 10.0.0 | 10.4.2 |
typo3/cms Packagist | From 10.0.0 | 10.4.2 |
typo3 Bitnami | From 10.4.0 to 10.4.0 | None |
typo3/cms-core Packagist | From 10.0.0 | 10.4.2 |
typo3/cms-core Packagist | From 10.0.0 | 10.4.2 |
Products include Typo3 Typo3.
How do I fix CVE-2020-11063?
Upgrade typo3/cms to 10.4.2 or later.
Is CVE-2020-11063 being exploited?
There is no known exploitation of CVE-2020-11063 in the wild and no public exploit code.
Other vulnerabilities in Typo3 Typo3
- CVE-2009-0258 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
- CVE-2011-3583 Typo3 SQL injection due to faulty prepared statements
- CVE-2011-4628 Typo3 Authentication Bypass
- CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3
- CVE-2021-41113 Cross-Site-Request-Forgery in Backend URI Handling in Typo3
Sources
Also known as BIT-typo3-2020-11063, GHSA-347x-877p-hcwx.