--- title: "TYPO3-PSA-2020-001: Critical vulnerability in legacy versions of TYPO3 CMS" url: "https://news.typo3.com/security/advisory/typo3-psa-2020-001" description: It has been discovered that TYPO3 CMS is susceptible to sensitive information disclosure in previous TYPO3 versions which are not maintained by the community anymore. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - Public Service Announcement --- # TYPO3-PSA-2020-001: Critical vulnerability in legacy versions of TYPO3 CMS - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2020-001: Critical vulnerability in legacy versions of TYPO3 CMS ========================================================================== 28 July 2020 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 CMS is susceptible to sensitive information disclosure in previous TYPO3 versions which are not maintained by the community anymore. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy) [TYPO3-EXT-SA-2020-014](https://typo3.org/security/advisory/typo3-ext-sa-2020-014) addresses the same vulnerability - the functionality has been extracted back then during TYPO3 v7 development to extension *mediace*. - **Component Type:** TYPO3 CMS - **Release Date:** July 28, 2020 - **Vulnerability Type:** Sensitive Information Disclosure - **Affected Versions:** 6.2.16-6.2.51 ELTS - **Severity:** critical - **Suggested CVSS:** [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C&version=3.1) - **References:** [CVE-2020-15086](https://nvd.nist.gov/vuln/detail/CVE-2020-15086) ### Problem Description It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below. - [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007), [CVE-2020-15099](https://nvd.nist.gov/vuln/detail/CVE-2020-15099): **Potential Privilege Escalation** - the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (7.5, high) - [TYPO3-CORE-SA-2016-013](https://typo3.org/security/advisory/typo3-core-sa-2016-013), [CVE-2016-5091](https://nvd.nist.gov/vuln/detail/CVE-2016-5091): **Insecure Deserialization & Remote Code Execution** - an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (9.1, critical) The overall severity of this vulnerability is **critical (9.1)** based on mentioned attack chains and the fact it does not require any privileges. Due to the seriousness and ease of exploitation of this vulnerability and the still widespread use of TYPO3 6.2, we have decided to make this update available to all TYPO3 6.2 users, not just [TYPO3 ELTS](https://typo3.com/products/extended-support) 6.2 customers. ### Solution Update to TYPO3 version [6.2.52 ELTS](https://get.typo3.org/release-notes/6.2.52). Outdated TYPO3 projects that are not covered by the ELTS release stream have to apply a patch file manually. - [typo3-psa-2020-001-6-2.patch](https://typo3.azureedge.net/typo3patches/typo3-psa-2020-001-6-2.patch) - [typo3-psa-2020-001-6-2.patch.sig](https://typo3.azureedge.net/typo3patches/typo3-psa-2020-001-6-2.patch.sig) (GPG detached signature) - **248ee155056037f142a4d3d718d52e99b074c503508ec1a2d4b06839b8b6fba9** (SHA256 checksum) ``` cd typo3_src wget typo3.azureedge.net/typo3patches/typo3-psa-2020-001-6-2.patch shasum -a 256 typo3-psa-2020-001-6-2.patch # please verify SHA256 checksum as shown above patch -p1 < typo3-psa-2020-001-6-2.patch rm typo3-psa-2020-001-6-2.patch ``` ###   ### Credits Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue. Thanks to TYPO3 GmbH team member Andreas Fernandez for providing the back-port to TYPO3 6.2. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ### General Note All security related code changes are tagged so that you can easily look them up in our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg) About the Author [Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy) [More posts by this author](https://news.typo3.com/article/author/zoe-legacy)