CVE-2013-7073
TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
Exploit likelihood
What each source reports
NVD Score used
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
- Record
CVE-2013-7073- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
- Record
CVE-2013-7073- Updated
- 2026-11-02
EUVDEUVD-2022-2443 No score
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
- Record
EUVD-2022-2443- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4rpv-g4gq-rh4m
TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
- Record
GHSA-4rpv-g4gq-rh4m- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-4rpv-g4gq-rh4m
TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
- Record
GHSA-4rpv-g4gq-rh4m- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-7073 No score
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
- Record
UBUNTU-CVE-2013-7073- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
4.5.0 to 4.5.31 | 4.5.32 |
typo3/cmsPackagist |
4.7.0 to 4.7.16 | 4.7.17 |
typo3/cmsPackagist |
6.0.0 to 6.0.11 | 6.0.12 |
typo3/cmsPackagist |
6.1.0 to 6.1.6 | 6.1.7 |
typo3-srcDebian:6.0 From an advisory covering 8 CVEs |
before 4.3.9+dfsg1-1+squeeze9, plus listed versions 4.3.9+dfsg1-14.3.9+dfsg1-1+squeeze14.3.9+dfsg1-1+squeeze24.3.9+dfsg1-1+squeeze34.3.9+dfsg1-1+squeeze4 Show 4 moreShow less4.3.9+dfsg1-1+squeeze54.3.9+dfsg1-1+squeeze64.3.9+dfsg1-1+squeeze74.3.9+dfsg1-1+squeeze8 |
4.3.9+dfsg1-1+squeeze9 |
typo3-srcDebian:7 From an advisory covering 8 CVEs |
before 4.5.19+dfsg1-5+wheezy2, plus listed versions 4.5.19+dfsg1-54.5.19+dfsg1-5+wheezy1 |
4.5.19+dfsg1-5+wheezy2 |
typo3/cmsPackagist |
4.5.0 up to 4.5.32 | 4.5.32 |
typo3/cmsPackagist |
4.7.0 up to 4.7.17 | 4.7.17 |
typo3/cmsPackagist |
6.0.0 up to 6.0.12 | 6.0.12 |
typo3/cmsPackagist |
6.1.0 up to 6.1.7 | 6.1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7073 is a medium vulnerability (CVSS 4.0) in Typo3, published December 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in typo3/cms 4.5.32.
References
seclists.org/oss-sec/2013/q4/487
lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004