GHSA-g585-crjf-vhwq json
TYPO3 Denial of Service in Frontend Record Registration
published 2y ago modified last yr.
- cvss
- 7.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
TYPO3’s built-in record registration functionality (aka `basic shopping cart`) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual session-data records in the database.
Patch / fix
- packagist typo3/cms 7.6.32, 8.7.21
- github.com/TYPO3/typo3@05011d1 commit
- github.com/TYPO3/typo3@fc2b4b9 commit
Is GHSA-g585-crjf-vhwq in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms | >=7.0.0, <7.6.32 >=8.0.0, <8.7.21 |
7.6.32 8.7.21 |
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/TYPO3/typo3/commit/05011d1248c54d00960e344fd920a6246da92415
web
-
github.com
/TYPO3/typo3/commit/fc2b4b9fb978088267f83e73cd401d4371dd40e3
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-7.yaml
web
-
github.com
/TYPO3/typo3
package
-
typo3.org
/security/advisory/typo3-core-sa-2018-012
web
Sources
- GitHub Advisory GHSA-g585-crjf-vhwq
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.