Advisory details:
github_osv / GHSA-jq6g-4v5m-wm9r
| Advisory ID | github_osv/GHSA-jq6g-4v5m-wm9r |
| Aliases |
CVE-2023-38499
|
| Summary | Information Disclosure due to Out-of-scope Site Resolution > ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (3.5) ### Problem In multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. ### Solution Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 that fix the problem described above. > ℹ️ **Strong security defaults - Manual actions required** > Resolving sites by the `id` and `L` HTTP query parameters is now denied per default. However, it is still allowed to resolve a particular page by e.g. `https://example.org/?id=123&L=0` - as long as the `page-id 123` is in the scope of the site configured for the `base-url example.org`. > The new feature flag `security.frontend.allowInsecureSiteResolutionByQueryParameters` - which is disabled per default - can be used to reactivate the previous behavior. ### Credits Thanks to Garvin Hicking who reported this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue. ### References * [TYPO3-CORE-SA-2023-003](https://typo3.org/security/advisory/typo3-core-sa-2023-003) |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 3.3 |
| Risk | 1.6 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 3.7 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-jq6g-4v5m-wm9r/GHSA-jq6g-4v5m-wm9r.json |
| generic_textual | LOW |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/TYPO3/typo3 | ||
| https://github.com/TYPO3/typo3/commit/702e2debd4b28f9cdb540544565fe6a8627ccb6a | ||
| https://typo3.org/security/advisory/typo3-core-sa-2023-003 | ||
| CVE-2023-38499 | https://nvd.nist.gov/vuln/detail/CVE-2023-38499 | |
| GHSA-jq6g-4v5m-wm9r | https://github.com/TYPO3/typo3/security/advisories/GHSA-jq6g-4v5m-wm9r |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-15T18:16:37Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2023/38xxx/CVE-2023-38499.json
Source Advisory: vulnrichment/CVE-2023-38499
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]