Vulnerability in typo3/cms-core (CVE-2020-11069)
Summary
Vulnerability in typo3/cms-core (CVE-2020-11069). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 10.4.2 or later.
Original description
The description as published by the source.
Meta
- CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- CWE-352
- CWE-346
Problem
It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session.
In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it’s actually a same-origin request forgery.
Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location.
The attacked victim requires an active and valid backend or install tool user sessions at the time of the attack to be successful.
Solution
Update to TYPO3 versions 9.5.17 or 10.4.2 that mitigates the problem described.
Additional Considerations
The deployment of additional mitigation techniques is suggested as described below.
Sudo Mode Extension
This TYPO3 extension intercepts modifications to security relevant database tables, e.g. those storing user accounts or storages of the f…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2020-11069 has been found in typo3/cms-core.
Successful exploitation can lead to full system takeover.
What to do: upgrade typo3/cms-core to 10.4.2 or later.
If unsure, ask your IT team or search "typo3/cms-core CVE-2020-11069" on the vendor's site.
CVE-2020-11069 (typo3/cms-core) — CWE-346
Attack vector: remote (network-reachable)
Patched: 10.4.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-346) exists in typo3/cms-core.
Check the vendor advisory for the affected versions of typo3/cms-core.
Severity: ?. Successful exploitation can lead to full system takeover.
Update to 10.4.2.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'typo3/cms-core' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'typo3/cms-core' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
typo3/cms-coreを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade typo3/cms-core to 10.4.2ステージング環境で 10.4.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web typo3.org