{"id":"CVE-2012-3529","aliases":["DSA-2537-1","EUVD-2022-2996","GHSA-7gg8-3r6j-5g55"],"status":"published","title":"Typo3 Backend Configuration XSS Vulnerability","description":"The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00839,"percentile":0.58072,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2012-08-30T00:00:00Z","modified":"2026-06-16T23:43:24Z","fixes":[{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["4.5.19","4.6.12","4.7.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.19"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6"},{"fixed":"4.6.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7"},{"fixed":"4.7.4"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"typo3-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9+dfsg1-1+squeeze5"}]}],"versions":["4.3.9+dfsg1-1","4.3.9+dfsg1-1+squeeze1","4.3.9+dfsg1-1+squeeze2","4.3.9+dfsg1-1+squeeze3","4.3.9+dfsg1-1+squeeze4"],"bundled":5},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.19"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6"},{"fixed":"4.6.12"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7"},{"fixed":"4.7.4"}]}]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/77793","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2537","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/08/22/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/50287","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://osvdb.org/84775","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3529","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7gg8-3r6j-5g55"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-3529","description":"The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.","status":"published","published":"2012-09-05T23:00:00Z","modified":"2024-08-06T20:05:12.93Z","updated_at":"2026-11-02T14:34:50.615647Z"}],"euvd":[{"id":"EUVD-2022-2996","description":"The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.","status":"published","published":"2012-09-05T23:00:00Z","modified":"2024-08-06T20:05:12Z","updated_at":"2026-11-03T01:56:10.882899Z"}],"ghsa":[{"id":"GHSA-7gg8-3r6j-5g55","title":"Typo3 Backend Configuration XSS Vulnerability","description":"The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.","status":"published","published":"2022-05-17T01:43:54Z","modified":"2024-01-12T18:12:28Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:30.812736Z"}],"nvd":[{"id":"CVE-2012-3529","description":"The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.","status":"published","published":"2012-09-05T23:55:02.1Z","modified":"2026-06-16T23:43:24.913Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:15.643902Z"}],"osv":[{"id":"DSA-2537-1","title":"typo3-src - several","status":"published","published":"2012-08-30T00:00:00Z","modified":"2026-03-09T01:19:53.604281Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-7gg8-3r6j-5g55","title":"Typo3 Backend Configuration XSS Vulnerability","description":"The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.","status":"published","published":"2022-05-17T01:43:54Z","modified":"2024-01-12T18:26:37.144295Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}