CVE-2020-11063: low-severity vulnerability in TYPO3 CMS
Observable Response Discrepancy in TYPO3 CMS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An attacker can exploit the password reset feature in TYPO3 CMS to discover which email addresses are registered as backend user accounts by measuring response times. This leaks information about valid users without needing a password.
CWE-204 vulnerability in TYPO3 CMS 10.4.0–10.4.1 allows timing-based user enumeration via the backend password reset functionality. An attacker can differentiate valid from invalid email addresses by analyzing response time discrepancies, enabling user account discovery without authentication.
In the same product, most dangerous first.