GHSA-pqfv-97hj-g97g: 
PHP vulnerability analysis and mitigation

A security vulnerability was discovered in TYPO3 CMS (GHSA-pqfv-97hj-g97g) affecting versions 6.2.0 to 6.2.14 and 7.0.0 to 7.3.1. The vulnerability, disclosed on September 8, 2015, allows unauthenticated path disclosure through a PHP script delivered with TYPO3 for testing purposes (TYPO3 Advisory).

The vulnerability is classified as an Information Disclosure issue with a Moderate severity rating (CVSS score 5.3). The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, and No user interaction needed. The vulnerability has a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (GitHub Advisory).

When exploited, the vulnerability discloses the absolute server path to the TYPO3 installation, potentially exposing sensitive system information to unauthorized users (TYPO3 Advisory).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (GitHub Advisory).

The vulnerability has been patched in TYPO3 versions 6.2.15 and 7.4.0. Users are advised to update to these or later versions to address the security issue (TYPO3 Advisory).