Description

The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.

Remediation

References

CVE-2009-0255

Related Vulnerabilities

Atlassian Confluence Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-3395)

Contao Deserialization of Untrusted Data Vulnerability (CVE-2014-1860)

SharePoint CVE-2021-40487 Vulnerability (CVE-2021-40487)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-8994)

WordPress Plugin WP User Frontend-Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission Supply Chain Attack [Polyfill.io] (4.0.7)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CVE-2009-0255