Servers and applications
CVE-2017-6370
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
- Severity
- Medium 5.3
- Published
- 17 Mar 2017
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1% in the next 30 daysHigher than 62% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Cleartext transmission (CWE-319)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
TYPO3Servers and applications · cpe:a:typo3:typo3 |
|