---
title: "TYPO3-CORE-SA-2019-001: Information Disclosure of Installed Extensions"
url: "https://news.typo3.com/security/advisory/typo3-core-sa-2019-001"
description: It has been discovered, that TYPO3 CMS is susceptible to information disclosure.
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - "Developer & Technology"
  - TYPO3 CMS
---

# TYPO3-CORE-SA-2019-001: Information Disclosure of Installed Extensions

- [Developer & Technology](https://news.typo3.com/article/category/developer-technology)
- Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms)

TYPO3-CORE-SA-2019-001: Information Disclosure of Installed Extensions
======================================================================

22 January 2019

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

It has been discovered, that TYPO3 CMS is susceptible to information disclosure.

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

- **Component Type:** TYPO3 CMS
- **Vulnerable subcomponent:** RequireJS package configuration
- **Release Date:** January 22, 2019
- **Vulnerability Type:** Information Disclosure
- **Affected Versions:** 8.0.0-8.7.22 and 9.0.0-9.5.3
- **Severity:** Low
- **Suggested CVSS v3.0:** [AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N/E:F/RL:O/RC:C)
- **CVE:** not assigned yet

### Problem Description

It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.

### Solution

Update to TYPO3 versions 8.7.23 or 9.5.4 that fix the problem described.

**Strong security defaults - Manual actions required**

 Since this bugfix introduces new configuration, it is required to clear TYPO3 caches - which can be done either by using the TYPO3 Install Tool or the TYPO3 Console CLI tool.

### Credits

Thanks to Sven Jürgens and Stefan Isak who reported this issue and to TYPO3 core team member Oliver Hader who fixed the issue.

### General Advice

Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list.

### General Note

All security related code changes are tagged so that you can easily look them up in our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z).

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

[More posts by this author](https://news.typo3.com/article/author/zoe-legacy)