-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 7.6.0, < 7.6.22 | 7.6.22 |
| typo3/cms | composer | >= 8.0.0, < 8.7.5 | 8.7.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper permission checks on file storage access. The StorageRepository class is central to TYPO3's file storage management. The getStorageObjects() method likely returned all available storages without applying proper user permission filters, enabling unauthorized access to protected storage metadata. This aligns with the vulnerability description where editors could discover protected storages. The high confidence comes from the pattern of storage handling in TYPO3 FAL and the nature of the vulnerability requiring a permission check fix in storage retrieval mechanisms.
Ongoing coverage of React2Shell