HOMEVULNERABILITIESCVE-2020-15098
HIGH

CVE-2020-15098

CWE-20Published: July 29, 2020· Updated: Jun 17, 2026

8.8
CVSS v3.1

Official Description

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.

NVD Source

Technical Analysis

CVE-2020-15098 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

typo31 product(s)
typo3
Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxp
ADVISORYhttps://typo3.org/security/advisory/typo3-core-sa-2016-013
ADVISORYhttps://typo3.org/security/advisory/typo3-core-sa-2020-008
ADVISORYhttps://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxp
ADVISORYhttps://typo3.org/security/advisory/typo3-core-sa-2016-013
ADVISORYhttps://typo3.org/security/advisory/typo3-core-sa-2020-008

All References (8)

→
https://github.com/TYPO3/TYPO3.CMS/commit/85d3e70dff35a99ef53f4b561114acfa9e5c47e1Broken Link
→
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxpThird Party Advisory
→
https://typo3.org/security/advisory/typo3-core-sa-2016-013Vendor Advisory
→
https://typo3.org/security/advisory/typo3-core-sa-2020-008Vendor Advisory
→
https://github.com/TYPO3/TYPO3.CMS/commit/85d3e70dff35a99ef53f4b561114acfa9e5c47e1Broken Link
→
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxpThird Party Advisory
→
https://typo3.org/security/advisory/typo3-core-sa-2016-013Vendor Advisory
→
https://typo3.org/security/advisory/typo3-core-sa-2020-008Vendor Advisory

Quick Facts

CVE IDCVE-2020-15098
CVSS Score8.8 / 10
SeverityHIGH
WeaknessCWE-20
CISA KEVNo
Affected1 vendor(s)
PublishedJul 29, 2020

Related CVEs (CWE-20)

CVE-2010-4727
10.0
CVE-2011-0485
10.0
CVE-2011-0471
10.0
CVE-2010-3491
10.0
CVE-2011-0478
10.0
CVE-2011-0921
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2020-15098 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2020-15098·NVD