CVE-2020-11067
Deserialization of Untrusted Data in TYPO3 CMS
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Deserialization of Untrusted Data in TYPO3 CMS
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
- Record
CVE-2020-11067- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2020-0403
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
- Record
EUVD-2020-0403- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2wj9-434x-9hvp
Insecure Deserialization in Backend User Settings in TYPO3 CMS
It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.
Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.
References
- Record
GHSA-2wj9-434x-9hvp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
- Record
CVE-2020-11067- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
- Record
CVE-2020-11067- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-2wj9-434x-9hvp
Insecure Deserialization in Backend User Settings in TYPO3 CMS
It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.
Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.
References
- Record
GHSA-2wj9-434x-9hvp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVBIT-typo3-2020-11067 No score
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.
- Record
BIT-typo3-2020-11067- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
9.0.0 up to 9.5.17 | 9.5.17 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.2 | 10.4.2 |
typo3/cmsPackagist |
10.0.0 up to 10.4.2 | 10.4.2 |
typo3/cmsPackagist |
9.0.0 up to 9.5.17 | 9.5.17 |
typo3Bitnami |
9.0.0 up to 9.5.16, 10.0.0 up to 10.4.1 | 9.5.1610.4.1 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.17, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 21 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.17 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2v10.3.0v10.4.0v10.4.1 |
10.4.2 |
typo3/cmsPackagist |
10.0.0 up to 10.4.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2v10.3.0v10.4.0v10.4.1 |
10.4.2 |
typo3/cmsPackagist |
9.0.0 up to 9.5.17, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 21 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11067 is a high vulnerability (CVSS 8.8) in Typo3, published May 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in typo3/cms-core 9.5.17.
References
github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-2wj9-434x-9hvp
nvd.nist.gov/vuln/detail/CVE-2020-11067
typo3.org/security/advisory/typo3-core-sa-2020-005