CVE-2020-11063
Observable Response Discrepancy in TYPO3 CMS
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Observable Response Discrepancy in TYPO3 CMS
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
- Record
CVE-2020-11063- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
EUVDEUVD-2020-0405
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
- Record
EUVD-2020-0405- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-347x-877p-hcwx
Information Disclosure in Password Reset
In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts.
This has been fixed in 10.4.2.
References
- Record
GHSA-347x-877p-hcwx- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203, CWE-204
- Updated
- 2026-11-02
NVD
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
- Record
CVE-2020-11063- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-204, CWE-203
- Updated
- 2026-11-02
OSV
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
- Record
CVE-2020-11063- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-347x-877p-hcwx
Information Disclosure in Password Reset
In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts.
This has been fixed in 10.4.2.
References
- Record
GHSA-347x-877p-hcwx- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203, CWE-204
- Updated
- 2026-11-02
OSVBIT-typo3-2020-11063 No score
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.
- Record
BIT-typo3-2020-11063- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
10.0.0 up to 10.4.2 | 10.4.2 |
typo3/cmsPackagist |
10.0.0 up to 10.4.2 | 10.4.2 |
typo3Bitnami |
10.4.0 to 10.4.0, 10.4.1 to 10.4.1 | None known |
typo3/cms-corePackagist |
10.0.0 up to 10.4.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2v10.3.0v10.4.0v10.4.1 |
10.4.2 |
typo3/cmsPackagist |
10.0.0 up to 10.4.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2v10.3.0v10.4.0v10.4.1 |
10.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11063 is a low vulnerability (CVSS 3.7) in Typo3, published May 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in typo3/cms-core 10.4.2.
References
github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx
nvd.nist.gov/vuln/detail/CVE-2020-11063
typo3.org/security/advisory/typo3-core-sa-2020-001