TYPO3 Same-Origin Request Forgery Vulnerability Advisory (CVE-2020-11069)

Vulnerability Overview Vulnerability Name: TYPO3-CORE-SA-2020-006: Same-Origin Request Forgery to Backend User Interface Vulnerability Type: Same-Origin Request Forgery (SORF) Severity: High CVSS Score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C Release Date: May 12, 2020 Affected Versions: 9.0.0–9.5.16, 10.0.0–10.4.1 References: CVE-2020-11069 CWE-352 CWE-346 Impact This vulnerability affects the TYPO3 CMS backend user interface and the installation tool. An attacker can exploit the victim’s user session privileges by inducing backend users to interact with malicious resources. In the worst-case scenario, an attacker can create new administrator users, which can be used directly for further attacks. Remediation 1. Update Version: Upgrade to TYPO3 versions 9.5.17 or 10.4.2, where this vulnerability has been fixed. 2. Enforce HTTP Referer Header: Ensure that requests originate from the TYPO3 backend user interface or the installation tool by enforcing the HTTP Referer header. This can be achieved by enabling . Specific methods include using the feature toggles in the installation tool or corresponding deployment techniques. 3. Sudo Mode Extension: Use the Sudo Mode extension, which intercepts modifications to security-related database tables and requires the user to re-enter their password to confirm the operation. 4. Content Security Policy (CSP): Configure Content Security Policies to prohibit script execution in specific locations. For example, prevent direct script execution in the and directories. Proof of Concept (PoC) Code / Exploit Code No specific PoC code or exploit code is provided in the document. Additional Recommendations Follow the security guidelines recommended by TYPO3. Subscribe to the TYPO3 announcement mailing list to receive the latest security updates. All security-related code changes are marked in the review system for easier identification. Author Information Author: Oliver Hader Position: Core Developer at TYPO3 GmbH, Hof, Germany Contact: Social media links provided Footer Information Copyright: © 2025 TYPO3 Association Legal Notice: Legal Notice, Privacy Policy Language Selection: Multilingual support available The above is a summary of the key information regarding the vulnerability extracted from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

TYPO3 Same-Origin Request Forgery Vulnerability Advisory (CVE-2020-11069)