CVE-2010-3673
TYPO3 is vulnerable to Information Disclosure in the HTML mailing API
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.
- Record
CVE-2010-3673- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.
- Record
CVE-2010-3673- Updated
- 2026-11-02
EUVDEUVD-2022-1633 No score
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.
- Record
EUVD-2022-1633- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5f2f-hr23-j59j
TYPO3 is vulnerable to Information Disclosure in the HTML mailing API
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.
- Record
GHSA-5f2f-hr23-j59j- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-5f2f-hr23-j59j
TYPO3 is vulnerable to Information Disclosure in the HTML mailing API
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.
- Record
GHSA-5f2f-hr23-j59j- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
before 4.2.13 | 4.2.13 |
typo3/cms-corePackagist |
4.3 up to 4.3.4 | 4.3.4 |
typo3/cms-corePackagist |
4.4 up to 4.4.1 | 4.4.1 |
typo3-srcDebian:5.0 From an advisory covering 16 CVEs |
before 4.2.5-1+lenny4, plus listed versions 4.2.5-14.2.5-1+lenny14.2.5-1+lenny24.2.5-1+lenny3 |
4.2.5-1+lenny4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3673 is a medium vulnerability (CVSS 5.3) in Typo3, published August 29, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in typo3/cms-core 4.2.13.
References
security-tracker.debian.org/tracker/CVE-2010-3673
bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719
typo3.org/security/advisory/typo3-sa-2010-012
nvd.nist.gov/vuln/detail/CVE-2010-3673
github.com/TYPO3/typo3/commit/3e24a0fff04897826a12e5cac16b5b0a3848cf2d