GHSA-pw2q-qwvj-gh43: Cache Flooding in TYPO3 Frontend
5.3
CVSS Score
3.1
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
-
Published
6/5/2024
Updated
6/5/2024
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, < 6.2.27 | 6.2.27 |
| typo3/cms | composer | >= 7.6.0, < 7.6.11 | 7.6.11 |
| typo3/cms | composer | >= 8.0.0, < 8.3.1 | 8.3.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from cHash not being page-bound in cache operations. Core caching functions in TypoScriptFrontendController and AbstractPlugin would handle cache key generation and validation(). The functions listed are standard TYPO3 cache handling mechanisms that would need modification to include page context in hash calculations, as indicated by the vulnerability description. While exact patch details are unavailable, these functions are central to the cache entry creation process() and match the described vulnerability pattern.