TYPO3 CMS Clipboard Broken Access Control Vulnerability

A broken access control vulnerability has been identified in the TYPO3 CMS clipboard functionality, allowing backend users to insert arbitrary records and files without proper read permission checks. This issue enables users to access information about records and files they are not authorized to view. The vulnerability affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

Impact

Exploitation of this vulnerability could lead to unauthorized access to records and files, allowing users to view information they are not permitted to.

Reproduction

To reproduce this vulnerability, a backend user can insert records or files into the TYPO3 clipboard without the necessary read permissions. The absence of permission checks during the clipboard insertion process allows for the unauthorized gathering of information about the inserted records or files.

Remediation

Users are advised to update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, or 14.3.3 LTS, all of which address this vulnerability.