GHSA-f624-8hfq-5fh3
TYPO3 Information Disclosure of Installed Extensions
GHSA-f624-8hfq-5fh3 is a medium vulnerability (CVSS 5.3) in typo3/cms, published June 7, 2024. No source lists public exploit code. Fixed in typo3/cms 8.7.23.
- Severity
- 5.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.7.23typo3/cms +3 more
Description
It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 8.0.0 up to 8.7.23 | 8.7.23 |
typo3/cmsPackagist | 9.0.0 up to 9.5.4 | 9.5.4 |
typo3/cmsPackagist | 8.0.0 up to 8.7.23, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 32 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 | 8.7.23 |
typo3/cmsPackagist | 9.0.0 up to 9.5.4, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 8 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3 | 9.5.4 |
What each source reports
GitHub Advisories Score used
TYPO3 Information Disclosure of Installed Extensions
It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.
- Record
GHSA-f624-8hfq-5fh3- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
TYPO3 Information Disclosure of Installed Extensions
It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.
- Record
GHSA-f624-8hfq-5fh3- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/TYPO3/typo3/commit/889ed77d2905d8b17afd31c723a23240c978823f
typo3.org/security/advisory/typo3-core-sa-2019-001