Description

TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

Remediation

References

CVE-2017-6370

Related Vulnerabilities

WordPress Plugin PowerPress Podcasting by Blubrry Cross-Site Scripting (10.0)

WordPress Plugin WP YouTube Live Cross-Site Scripting (1.8.2)

Zope Web Application Server Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability (CVE-2021-32811)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-6131)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-3454)

Severity

Medium

Classification

CVE-2017-6370 CWE-319 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities