CVE-2009-0255

The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

9.44% chance of exploitation in the next 30 days, 95th percentile

Published

2009-01-22

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/typo3_sa_2009_001.rb

Security advisories

• http://secunia.com/advisories/33617
• http://secunia.com/advisories/33679
• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001
• http://www.securityfocus.com/bid/33376
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48132

References

• CVE Record
• NVD entry