Detections
Analytics

SCA: security update for typo3/cms, typo3/cms-core (GHSA-m5vr-3m74-jwxp)

high Tenable Self-Hosted Container Security Plugin ID 416759

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and
 less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate
 arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message
 authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege
 escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability
 is high based on mentioned attack chains and the requirement of having a valid backend user session
 (authenticated). This has been patched in versions 9.5.20 and 10.4.6. (CVE-2020-15098)

See Also

https://github.com/advisories/GHSA-m5vr-3m74-jwxp

Plugin Details

Severity: High

ID: 416759

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2020-15098

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/29/2020

Vulnerability Publication Date: 7/29/2020

Reference Information

CVE: CVE-2020-15098