CVE-2020-15098
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 2.36%
- CWE
- CWE-325, CWE-20, CWE-200, CWE-502
- Published
- 2020-07-29
- Last modified
- 2026-03-14
Affected products
- TYPO3 TYPO3 CMS
- TYPO3 TYPO3 CMS
Weakness type
Related vulnerabilities
- CVE-2020-15086 — Potential Remote Code Execution in TYPO3 with mediace extension
- CVE-2026-22863 — Deno node:crypto doesn't finalize cipher
- CVE-2025-30147 — ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve
- CVE-2018-5383 — Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange
- CVE-2026-4601 — Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.sig
- CVE-2023-46129 — xkeys Seal encryption used fixed key for all encryption
- CVE-2022-20742 — Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure Vulnerability
- CVE-2026-76784 — Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices