CVE-2020-11067CWE-502

Deserialization of Untrusted Data in TYPO3 CMS

High · published May 13, 2020

CVSS v3.1
8.8
EPSS
2%
Percentile
80.5
In the wild
Unconfirmed
What it is

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01990 · 80.5th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2020-05-13T23:25Z
EPSS history
Timeline
  • 13 MAY 23:25Z
    Deserialization of Untrusted Data in TYPO3 CMS
    cvelistv5