EUVD-2026-65344
GHSA-8j7q-247m-7f82
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because OpenSSL must be absent on the server (deployment-dependent precondition); PR:L for API key requirement; only confidentiality impact applies per description.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
AnalysisAI
Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension when OpenSSL is absent on the hosting server, exposing potentially sensitive configuration and system data to network interception (CWE-319). All tracked versions of the extension are affected per CPE data, though exploitation is constrained by the dual requirement of OpenSSL being unavailable and the attacker already possessing the SYSSY project's API key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit prerequisites must be simultaneously satisfied: (1) the target TYPO3 server must not have the OpenSSL PHP extension available - this is the trigger for the insecure cleartext fallback; and (2) the attacker must already be in control of the SYSSY project's API key, as stated directly in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N yields a score of 5.3 (Medium), indicating network-accessible exploitation requiring low privileges with limited confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained or compromised the SYSSY project's API key positions themselves to intercept network traffic between a TYPO3 host (running without OpenSSL) and the SYSSY monitoring service. Because the extension transmits system information in cleartext under these conditions, the attacker can passively capture TYPO3 configuration details, version data, and security check results without triggering alerts. … |
| Remediation | Consult the TYPO3 vendor advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-015 for the official patched version, which was not independently confirmed in the available data (patch available per vendor advisory, exact fix version unconfirmed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today