CVE-2025-47937CWE-863

TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling

Low · published May 20, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-05-20T13:47Z
EPSS history
Timeline
  • 20 MAY 13:47Z
    TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling
    cvelistv5