CVE-2020-11067

Summary

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

Affected Software

VendorProductVersion RangeStatus
TYPO3TYPO3 CMS>= 9.0.0, < 9.5.17affected
TYPO3TYPO3 CMS>= 10.0.0, < 10.4.2affected

Weaknesses

  • CWE-502: CWE-502: Deserialization of Untrusted Data

ADP Enrichment

CVE Program Container

Additional References

References