5.3med
CVE-2017-6370
TYPO3 Information Disclosure Vulnerability
Also known as GHSA-87hc-phmj-rhgh
Published 9 y ago · modified 4 mo ago · JSON
CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 63%
Public exploits
0
none known
Summary
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
Exploit prediction (EPSS)
0.99% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | typo3/cms | 1 listed versions | no fix listed |
Classification
- Weakness
- CWE-319 Cleartext Transmission of Sensitive Information
References
- securityfocus.com /bid/97071 · vdb-entry, x_refsource_BID, x_transferred
- github.com /faizzaidi/TYPO3-v7.6.15-Unencrypted-Login-Request · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-6370 · advisory
- github.com /TYPO3/typo3 · package
Sources
- CVE List: CVE-2017-6370
- GitHub Advisory: GHSA-87hc-phmj-rhgh
- NVD: CVE-2017-6370
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.