« Volver al listado

CVE-2025-47937

Estado: AnalizadaMedia (5.3)—

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Typo3 — Typo3

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47937",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47937",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-20T13:57:34.105162Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "TYPO3",
          "product": "typo3",
          "versions": [
            {
              "status": "affected",
              "version": ">= 9.0.0, < 9.5.51"
            },
            {
              "status": "affected",
              "version": ">= 10.0.0, < 10.4.50"
            },
            {
              "status": "affected",
              "version": ">= 11.0.0, < 11.5.44"
            },
            {
              "status": "affected",
              "version": ">= 12.0.0, < 12.4.31"
            },
            {
              "status": "affected",
              "version": ">= 13.0.0, < 13.4.12"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-20T14:15:50.460",
  "references": [
    {
      "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-x8pv-fgxp-8v3x",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2025-011",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem."
    },
    {
      "lang": "es",
      "value": "TYPO3 es un sistema de gestión de contenido web de código abierto basado en PHP. A partir de la versión 9.0.0 y anteriores a las versiones 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS y 13.4.12 LTS, al realizar una consulta de base de datos que involucra varias tablas a través de la capa de abstracción de base de datos (DBAL), los permisos de usuario frontend solo se aplican mediante `FrontendGroupRestriction` a la primera tabla. Como resultado, los datos de tablas adicionales incluidas en la misma consulta podrían quedar expuestos involuntariamente a usuarios no autorizados. Los usuarios deben actualizar a las versiones 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS o 13.4.12 LTS de TYPO3 para solucionar el problema."
    }
  ],
  "lastModified": "2026-06-17T09:28:51.920",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C934C013-7EE6-4A22-82D1-A3BEAF737E93",
              "versionEndExcluding": "9.5.51",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "715A1114-6067-492F-B0D8-35E2A716384E",
              "versionEndExcluding": "10.4.50",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F1A88B2-0BFA-42E7-8F49-835C8F2D4E3F",
              "versionEndExcluding": "11.5.44",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05F9DC80-7BBC-42A0-800E-EF90CA604C7F",
              "versionEndExcluding": "12.4.31",
              "versionStartIncluding": "12.0.0"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10E529B8-AA31-4603-800C-39AF3CCBA1E7",
              "versionEndExcluding": "13.4.12",
              "versionStartIncluding": "13.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}