Skip to content
Fencer Vulns
critical 9.8

CVE-2020-15086 json

Potential Remote Code Execution in TYPO3 with mediace extension

published 2020-07-29 6 y ago modified 2026-07-08 4 mo ago also GHSA-4h44-w6fm-548g , EUVD-2020-0535

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.6%
EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3.

Patch / fix

  • packagist friendsoftypo3/mediace 7.6.5
  • typo3 mediace 7.6.5

Exploit prediction

3.56% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/FriendsOfTYPO3/mediace/security/advisories/GHSA-4h44-w6fm-548g referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist friendsoftypo3/mediace
>=7.6.2, <7.6.5
7.6.5

Affected products

  • FriendsOfTYPO3 mediace

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-325 Missing Cryptographic Step
  • CWE-502 Deserialization of Untrusted Data
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.