What’s Vulnerable › Vulnerabilities

CVE-2020-26228: Cleartext storage of session identifier

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-23 · updated 2026-06-17
• Weakness: CWE-312

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

Affected products

• typo3: from 9.0.0 before 9.5.23; from 10.0.0 before 10.4.10 — fixed in 10.4.10, 9.5.23

How to fix

Upgrade to a fixed version: typo3 10.4.10, 9.5.23. Check the vendor advisory for mitigations.

References

• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-954j-f27r-cj52
• https://typo3.org/security/advisory/typo3-core-sa-2020-011
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-954j-f27r-cj52
• https://typo3.org/security/advisory/typo3-core-sa-2020-011

Get alerted when CVE-2020-26228 or the next vulnerability affects your stack