Information disclosure in Typo3
CVE-2023-47126
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Information Disclosure
EPSS: 0.007 (47.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Typo3 — versions >= 12.2.0, < 12.4.8
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-47126?
- CVE-2023-47126 is a low-severity vulnerability in Typo3, classified under Information Disclosure. CVSS score: 3.7/10. Published 2023-11-14.
- How severe is CVE-2023-47126?
- Low severity. CVSS v3 base score is 3.7 out of 10.