Description (CNA)
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TYPO3 / TYPO3 CMS | affected 12.0.0 before 12.4.37; affected 13.0.0 before 13.4.18 |
| TYPO3 / TYPO3 CMS | affected 11.0.0 before 11.5.48 |
CWE
CWE-200
References
ADP enrichment
No English description supplied.
No references supplied.