Skip to content
Fencer Vulns
high 8.1

CVE-2020-15099 json

Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

published 2020-07-29 6 y ago modified 2026-07-08 4 mo ago also BIT-typo3-2020-15099 , EUVD-2020-0533 , GHSA-3x94-fv5h-5q2c

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php, which again contains the encryptionKey as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network, this allows the ability to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. This has been patched in versions 9.5.20 and 10.4.6.

Patch / fix

  • packagist typo3/cms-core 9.5.20, 10.4.6
  • packagist typo3/cms 9.5.20, 10.4.6
  • bitnami typo3 9.5.20, 10.4.6
  • typo3 typo3 9.5.20, 10.4.6

Exploit prediction

1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist typo3/cms-core
>=9.0.0, <9.5.20
>=10.0.0, <10.4.6
9.5.20
10.4.6
packagist typo3/cms
>=10.0.0, <10.4.6
>=9.0.0, <9.5.20
10.4.6
9.5.20
bitnami typo3
>=9.0.0, <9.5.20
>=10.0.0, <10.4.6
9.5.20
10.4.6

Affected products

  • TYPO3 TYPO3 CMS

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.