Description
The web application is based on Typo3 CMS. Typo3 Install Tool is enabled and publicly accessible. If an attacker manages to brute force the Install Tool password, they will get full access to the web applicaiton.
Remediation
Restrict access to Typo3 Install Tool.
References
Related Vulnerabilities
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6332)
WordPress Plugin Count per Day Information Disclosure (3.2.5)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-7831)
WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.7)
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-9855)