UpHeron
All vulnerabilities

Servers and applications

CVE-2020-11063

Information Disclosure in Password Reset

Severity
Low 3.7
Published
12 May 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-347x-877p-hcwx
Sources
NVD, Project advisories (GitHub)

Description

In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.

Affected software

SoftwareAffected versions
TYPO3Servers and applications · cpe:a:typo3:typo3
  • Version 10.4.0
  • Version 10.4.1
TYPO3Servers and applications · github:typo3/typo3
  • Version 10.4.0
  • Version 10.4.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-11063
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-11063
  • GitHub Advisory Database https://github.com/advisories/GHSA-347x-877p-hcwx
  • github.com https://github.com/TYPO3/typo3/security/advisories/GHSA-347x-877p-hcwx