GHSA-66c2-7g4p-wx4p: 
PHP vulnerability analysis and mitigation

The TYPO3 CMS Install Tool was discovered to have an information disclosure vulnerability (GHSA-66c2-7g4p-wx4p) that exposes the current TYPO3 version number to non-authenticated users. The vulnerability was reported and disclosed on December 11, 2018, affecting TYPO3 CMS versions 7.0.0-7.6.31, 8.0.0-8.7.20, and 9.0.0-9.5.1 (TYPO3 Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Moderate severity) with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: Low, Integrity: None, Availability: None. The vulnerability is classified as CWE-200 (Information Disclosure) (GitHub Advisory).

The vulnerability allows unauthorized users to obtain information about the TYPO3 version number through the Install Tool. While the severity is rated as low, version information disclosure could potentially assist attackers in identifying vulnerable systems and planning targeted attacks (TYPO3 Advisory).

The vulnerability requires no special privileges or user interaction to exploit, with network-based attack vector making it remotely exploitable. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit (GitHub Advisory).

The vulnerability has been patched in TYPO3 versions 7.6.32, 8.7.21, and 9.5.2. Users are advised to update to these patched versions to address the information disclosure issue. The fix was implemented by TYPO3 core team member Benni Mack (TYPO3 Advisory).