Vulnerability Database
289,871
Total vulnerabilities in the database
CVE-2020-26228
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.
| Software | From | Fixed in |
|---|---|---|
| typo3 / typo3 | 10.0.0 | 10.4.10 |
| typo3 / typo3 | 9.0.0 | 9.5.23 |
typo3 / cms-core
|
9.0.0 | 9.5.23 |
|
typo3 / cms-core
|
10.0.0 | 10.4.10 |