TYPO3 Faceted Search Extension Arbitrary Data Indexing Vulnerability

A vulnerability in the TYPO3 extension 'Faceted Search' (ke_search) allows backend users with permission to edit indexer configurations to index sensitive data from internal TYPO3 tables. This issue arises because the 'additional_tables' configuration of the page and tt_content indexers accepts arbitrary table and field names. Exploitation of this vulnerability could lead to unauthorized information disclosure.

Impact

Exploitation of this vulnerability could result in the unauthorized indexing of sensitive data from internal TYPO3 tables, potentially leading to information disclosure.

Remediation

Users of the 'Faceted Search' extension are advised to update to version 7.0.1, 6.6.1, or 5.6.2. These versions are available from the TYPO3 extension manager, Packagist, and the TYPO3 Extensions Repository.