CVE-2023-47126: Information Disclosure in typo3/cms-install tool

November 14, 2023

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

github.com/TYPO3/typo3/commit/1a735dac01ec7b337ed0d80c738caa8967dea423
github.com/TYPO3/typo3/security/advisories/GHSA-p2jh-95jg-2w55
github.com/advisories/GHSA-p2jh-95jg-2w55
nvd.nist.gov/vuln/detail/CVE-2023-47126
typo3.org/security/advisory/typo3-core-sa-2023-005

Detect and mitigate CVE-2023-47126 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →