CVE-2020-26228
HIGHTYPO3 9.0.0-9.5.22 and 10.0.0-10.4.9 - Cleartext Storage of Sensitive Information
Title source: llmDescription
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-954j-f27r-cj52
Vendor Advisory x_refsource_misc
https://typo3.org/security/advisory/typo3-core-sa-2020-011
Scores
CVSS v3
8.1
EPSS
0.0018
EPSS Percentile
38.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-312
Status
published
Products (3)
typo3/cms
10.0.0 - 10.4.10Packagist
typo3/cms-core
9.0.0 - 9.5.23Packagist
typo3/typo3
9.0.0 - 9.5.23
Published
Nov 23, 2020
Tracked Since
Feb 18, 2026