TYPO3 contains a flaw that may allow a malicious user to crack its encryption key. The System Extension Install Tool creates the key using an insufficiently random seed. It is possible that the flaw may allow the key to be compromised resulting in a loss of confidentiality.
Classification
Location:
Remote / Network Access
Attack Type:
Cryptographic
Impact:
Loss of Confidentiality
Solution:
Upgrade
Exploit:
Exploit Public
Disclosure:
Vendor Verified
Solution
Upgrade to version 4.0.10, 4.1.8, 4.2.4 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
c22.cc -
Raiffeisen Informatik CERT
