---
title: "TYPO3-SA-2010-004: Vulnerabilities in TYPO3 Core"
url: "https://news.typo3.com/security/advisory/typo3-sa-2010-004"
description: It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, Authentication Bypass for frontend users and Information Disclosure.
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - "Product Updates & Roadmap"
  - Security
---

# TYPO3-SA-2010-004: Vulnerabilities in TYPO3 Core

- [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap)
- [Security](https://news.typo3.com/article/category/security-1)

TYPO3-SA-2010-004: Vulnerabilities in TYPO3 Core
================================================

23 February 2010

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, Authentication Bypass for frontend users and Information Disclosure.

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7569d41262328e5ed8d27b53e03970ec.png)[Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel)

**Component Type:** TYPO3 Core

**Affected Versions:** 4.2.11 and below, 4.3.1 and below

**Vulnerability Types:** Authentication Bypass, Cross-Site Scripting (XSS), Information Disclosure

**Overall Severity:** High

**Release Date:** February 23, 2010

Vulnerable subcomponent #1: Backend
-----------------------------------

**Vulnerability Type:** Information Disclosure

**Severity:** Medium

**Problem Description:** When a sys\_action task is set up for creation of new backend users, the executing (unprivileged) user can get hold of personal data (except the password) of any existing backend user. A valid backend login is required to exploit this vulnerability.

**Solution:** Update to the TYPO3 versions 4.2.12 or 4.3.2 that fix the problem described.

**Credits:** Credits go to Security Team member Georg Ringer who discovered and reported the issue.

**Vulnerability Type:** Cross-Site Scripting

**Severity:** Medium

**Problem Description:** Failing to sanitize user input the TYPO3 backend is susceptible to XSS attacks in several places. A valid backend login is required to exploit these vulnerabilities.

**Solution:** Update to the TYPO3 versions 4.2.12 or 4.3.2 that fix the problem described.

**Credits:** Credits go to Nikolas Hagelstein and Jelmer de Hen along with Security Team members Marcus Krause and Georg Ringer who discovered and reported the issues.

Vulnerable subcomponent #2: Frontend
------------------------------------

**Vulnerability Type:** Cross-Site Scripting

**Severity:** Medium

**Problem Description:** When running TYPO3 on PHP as CGI, under certain circumstances, a malicious URL parameter can be provided for the index.php, forcing TYPO3 to output an error message and showing arbitrary injected HTML.

**Solution:** Update to the TYPO3 versions 4.2.12 or 4.3.2 that fix the problem described.

**Credits:** Credits go to Henry Sudhof who discovered and reported the issue.

Vulnerable subcomponent #3: Frontend Login
------------------------------------------

**Vulnerability Type:** Authentication Bypass

**Severity:** High

**Problem Description:** When using system extension "saltedpasswords" under certain circumstances, an attacker doesn't need to know the original clear text password to successfully log in as a frontend user. If the TYPO3 CMS is configured to use several authentication services for the frontend, knowing the salted hashed password will enable an attacker to authenticate against the system. Only TYPO3 versions 4.3.x with enabled system extension "saltedpasswords" are affected.

TYPO3 system extension "saltedpasswords" is disabled by default; enabling it requires a manual change in system configuration.

**Solution:** Update to the TYPO3 versions 4.3.2 that fix the problem described or configure "saltedpasswords" to be the only authentication service (see its manual) for frontent users.

**Credits:** Credits go to Sven Haertwig who discovered and reported the issue.

**General Advice:** Follow the recommendations that are given in the [TYPO3 SECURITY Guide](https://docs.typo3.org/typo3cms/SecurityGuide). Please subscribe to the typo3-announce mailing list

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bb9efc51bced8582e7b8c235f4b5f2b5.png)

About the Author

[Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel)

[More posts by this author](https://news.typo3.com/article/author/helmut-hummel)