Description

The web application is based on Typo3 CMS. Typo3 Install Tool is enabled and publicly accessible. If an attacker manages to brute force the Install Tool password, they will get full access to the web applicaiton.

Remediation

Restrict access to Typo3 Install Tool.

References

The Install Tool

Related Vulnerabilities

ZK Framework AuUploader Information Disclosure (CVE-2022-36537)

WordPress Plugin Advanced Contact form 7 DB Information Disclosure (1.1.0)

Oracle Database Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2007-5554)

WordPress Plugin Customer Reviews for WooCommerce Multiple Vulnerabilities (5.3.5)

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Multiple Vulnerabilities (3.4.33)

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P

Tags

Insecure Admin Access