title: typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution
description: TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.
problem types: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
vendor: TYPO3
product: typo3
versions:
version: >= 9.4.0, < 9.5.42, status: affected
version: >= 10.0.0, < 10.4.39, status: affected
version: >= 11.0.0, < 11.5.30, status: affected
version: >= 12.0.0, < 12.4.4, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]