CVE-2010-3714

TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism

7.1 HighPublic exploitFix available

The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.

Exploit likelihood

24.1%Down 10.8 points since Feb 4, 2022

What each source reports

NVD Score used 7.1

Record: CVE-2010-3714
CVSS 2.0: 7.1 HighAV:N/AC:M/Au:N/C:C/I:N/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-3714
Updated: 2026-11-02

EUVDEUVD-2022-5516 No score

Record: EUVD-2022-5516
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w736-qv86-vq94 No score

TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism

The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.

Record: GHSA-w736-qv86-vq94
Weakness: CWE-284
Updated: 2026-11-02

OSVGHSA-w736-qv86-vq94 No score

TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism

Record: GHSA-w736-qv86-vq94
Weakness: CWE-284
Updated: 2026-11-02

Affected products

typo3

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms` Packagist	4.2.0 up to 4.2.15	4.2.15
`typo3/cms` Packagist	4.3.0 up to 4.3.7	4.3.7
`typo3/cms` Packagist	4.4.0 up to 4.4.4	4.4.4
`typo3-src` Debian:5.0 From an advisory covering 5 CVEs	before 4.2.5-1+lenny6, plus listed versions 4.2.5-14.2.5-1+lenny14.2.5-1+lenny24.2.5-1+lenny34.2.5-1+lenny44.2.5-1+lenny5	4.2.5-1+lenny6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	TYPO3 - Arbitrary File Retrieval	2010-12-29
Metasploit	TYPO3 sa-2010-020 Remote File Disclosure

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-3714 is a high vulnerability (CVSS 7.1) in Typo3, published October 19, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.1%, the 97th percentile. Fixed in typo3/cms 4.2.15.

References

Show 6 moreShow less