Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-usmv-r64u-m7cb
Vulnerability ID VCID-usmv-r64u-m7cb
Aliases CVE-2020-11063
GHSA-347x-877p-hcwx
Summary Information Disclosure in Password Reset In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2. ### References * https://typo3.org/security/advisory/typo3-core-sa-2020-001
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-203 Observable Discrepancy
CWE-204 Observable Response Discrepancy
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
epss 0.00292 https://api.first.org/data/v1/epss?cve=CVE-2020-11063
cvssv3.1_qr LOW https://github.com/advisories/GHSA-347x-877p-hcwx
cvssv3.1 3.7 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yaml
generic_textual LOW https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yaml
cvssv3.1 3.7 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yaml
generic_textual LOW https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yaml
cvssv3.1 3.7 https://github.com/TYPO3/typo3
generic_textual LOW https://github.com/TYPO3/typo3
cvssv3.1 3.7 https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx
cvssv3.1_qr LOW https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx
generic_textual LOW https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx
cvssv3.1 3.7 https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574
generic_textual LOW https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574
cvssv3.1 3.7 https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx
cvssv3.1_qr LOW https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx
generic_textual LOW https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx
cvssv3.1 3.7 https://nvd.nist.gov/vuln/detail/CVE-2020-11063
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2020-11063
cvssv3.1 3.7 https://typo3.org/security/advisory/typo3-core-sa-2020-001
generic_textual LOW https://typo3.org/security/advisory/typo3-core-sa-2020-001
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-11063
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yaml
https://github.com/TYPO3/typo3
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx
https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574
https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx
https://nvd.nist.gov/vuln/detail/CVE-2020-11063
https://typo3.org/security/advisory/typo3-core-sa-2020-001
GHSA-347x-877p-hcwx https://github.com/advisories/GHSA-347x-877p-hcwx
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11063.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11063.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/TYPO3/typo3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-347x-877p-hcwx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/TYPO3/typo3/commit/14929b98ecda0ce67329b0f25ca7c01ee85df574
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11063
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://typo3.org/security/advisory/typo3-core-sa-2020-001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.52452
EPSS Score 0.00292
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:33.816222+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-347x-877p-hcwx/GHSA-347x-877p-hcwx.json 38.0.0