CVE-2020-11063: 
PHP vulnerability analysis and mitigation

A time-based information disclosure vulnerability was discovered in TYPO3's password reset functionality for backend users (CVE-2020-11063). The vulnerability was reported in May 2020 and affected TYPO3 versions 10.4.0 and 10.4.1. This security flaw was assigned a low severity rating and was subsequently patched in version 10.4.2 (GitHub Advisory).

The vulnerability exists in the password reset mechanism where time-based attacks could be leveraged to perform user enumeration. The CVSS v3.1 score for this vulnerability is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C, indicating a network-accessible vulnerability with high attack complexity and low confidentiality impact (GitHub Advisory).

The vulnerability allows attackers to perform user enumeration based on email addresses assigned to backend user accounts. By analyzing the response time of password reset requests, attackers could potentially determine whether specific email addresses are associated with valid backend user accounts (GitHub Advisory).

The vulnerability requires no user interaction or privileges to exploit, though it does require high attack complexity. The attack vector is network-accessible, allowing remote exploitation through timing analysis of password reset requests (GitHub Advisory).

The vulnerability was patched in TYPO3 version 10.4.2. The fix implements a random delay between 200 milliseconds and 3 seconds before sending the response to the client, effectively preventing time-based information disclosure. Users are advised to upgrade to version 10.4.2 or later to address this security issue (GitHub Commit).