CVE-2009-0815

Published: Mar 5, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.

Affected (24)

Products: Typo3: Typo3

Typo3

1 product

Typo3

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Typo3 Typo3	Version 3.3.x
Typo3 Typo3	Version 3.5.x
Typo3 Typo3	Version 3.6.x
Typo3 Typo3	Version 3.7.x
Typo3 Typo3	Version 3.8.x
Typo3 Typo3	Version 4.0
Typo3 Typo3	Version 4.1.0
Typo3 Typo3	Version 4.1.2
Typo3 Typo3	Version 4.1.3
Typo3 Typo3	Version 4.1.4
Typo3 Typo3	Version 4.1.5
Typo3 Typo3	Version 4.1.6
Typo3 Typo3	Version 4.1.7
Typo3 Typo3	Version 4.1.8
Typo3 Typo3	Version 4.1.9
Typo3 Typo3	Version 4.1
Typo3 Typo3	Version 4.2.0
Typo3 Typo3	Version 4.2.1
Typo3 Typo3	Version 4.2.2
Typo3 Typo3	Version 4.2.3
Typo3 Typo3	Version 4.2.4
Typo3 Typo3	Version 4.2.5
Typo3 Typo3	Version 4.2
Typo3 Typo3	Version 4.3 alpha1