-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe core vulnerability stemmed from two key issues: 1) In class.tslib_fe.php, the loose comparison (==) in jumpUrl() allowed hash spoofing via PHP type juggling, as demonstrated by the patch replacing '==' with '==='. 2) In class.tslib_content.php, the use of shortMD5 for hash generation (instead of HMAC) created a weaker cryptographic foundation. The combination of these flaws enabled remote file disclosure. The high confidence in tslib_fe::jumpUrl is based on direct evidence from the patch diff and CVE description, while the medium confidence in tslib_content::locDataJU reflects its supporting role in the vulnerability chain.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 4.2.0, < 4.2.15 | 4.2.15 |
| typo3/cms | composer | >= 4.3.0, < 4.3.7 | 4.3.7 |
| typo3/cms | composer | >= 4.4.0, < 4.4.4 | 4.4.4 |