CVE-2020-11069 describes a same-site request forgery vulnerability in TYPO3 CMS versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1. This flaw allows an attacker to trick a backend user into interacting with a malicious resource, leading to script execution with the victim's session privileges. The vulnerability carries a CVSS score of 8.8 (High), indicating a critical risk due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability, potentially allowing for the creation of new admin users. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 9.0.0, <= 9.5.16CPE matchmatch criteria | cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* | ||
>= 10.0.0, <= 10.4.1CPE matchmatch criteria | cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.