Detections
Analytics

SCA: security update for typo3/cms, typo3/cms-core (GHSA-2rxh-h6h9-qrqc)

critical Tenable Self-Hosted Container Security Plugin ID 422204

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and
 less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of
 dynamically-determined object attributes and result in triggering deletion of an arbitrary directory in
 the file system, if it is writable for the web server. It can also trigger message submission via email
 using the identity of the web site (mail relay). Another insecure deserialization vulnerability is
 required to actually exploit mentioned aspects. This has been fixed in 9.5.17 and 10.4.2. (CVE-2020-11066)

See Also

https://github.com/advisories/GHSA-2rxh-h6h9-qrqc

Plugin Details

Severity: Critical

ID: 422204

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 56.9

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2020-11066

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/13/2020

Vulnerability Publication Date: 5/13/2020

Reference Information

CVE: CVE-2020-11066