Professional Content Management

Free and open source, TYPO3 CMS is the most widely used enterprise-level CMS.

Test TYPO3 now:

TYPO3 live demo

Inspire people to share

Offer your skills and contribute to the project. The community is growing and does more than just coding. 

A Community Effort

TYPO3 CMS is an Open Source project managed by the TYPO3 Association.

The Project

Do you have a question?

Ask the community or a professional partner.

SECURITY-BULLETIN-TYPO3-20050725-1: Security Bulletin TYPO3-20050725-1

Categories: Security Created by Karsten Dambekalns
Possible Information leak. The TYPO3 Security Team has issued another security bulletin which explains and fixes a possible problem with a debug script in TYPO3.

Version: 3.8.0 and earlier

Vulnerability Type: Information Disclosure

Severity: Low

Problem Description:

A debug script exposes system information provided by phpinfo(). The script can be executed by a remote user.

Solution:

Remove the script, apply a patch or restrict access to the directory.

  • Remove the directory typo3_src-3.x.x/misc/phpcheck
  • A patch to prevent execution of the script is available. In typo3_src-3.x.x/misc/phpcheck/incfile.php, it inserts a die() function on top of the code. You can find it on bugs.typo3.org/view.php
  • Use any of the favorite access restriction methods of your webserver. For example, in Apache, use mod_access or mod_auth directives.

Additional information:

This issue is fixed in the CVS version of the TYPO3 core and will be fixed in 3.8.1 as well.

References:

TYPO3 bugtracker, ID #1250 at bugs.typo3.org/view.php

Credits:

Thanks to Christian Lerrahn for pointing out this issue to us.