MediumGHSA-87hc-phmj-rhghCVE-2017-6370

TYPO3 Information Disclosure Vulnerability

Published 13 May 2022 · Updated 25 Apr 2024

Affected package

typo3/cmsComposer
Affected
7.6.15
Fixed in
No fix released

Details

TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

Is GHSA-87hc-phmj-rhgh in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3/cms, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.