GHSA-q9c4-9v5m-597p: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-q9c4-9v5m-597p) titled 'Information Disclosure in Backend User Interface' was discovered in TYPO3 CMS and disclosed on June 25, 2019. This security issue affects TYPO3 CMS versions 8.0.0-8.7.26 and 9.0.0-9.5.7. The vulnerability is specifically located in the Backend User Interface (ext:backend) component of the TYPO3 CMS system (TYPO3 Advisory).

The vulnerability is classified as an Information Disclosure issue with a Medium severity rating. According to the CVSS v3.0 scoring, it has been suggested as AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The element information component, which is responsible for displaying properties of certain records, contains a security flaw where the list of references from or to the record is not properly checked for backend user permissions (TYPO3 Advisory).

The vulnerability could lead to information disclosure where unauthorized users with valid backend access could potentially view record information beyond their permission level. The impact is limited to confidentiality breaches, with no direct effect on system integrity or availability (TYPO3 Advisory).

Exploitation of this vulnerability requires a valid backend user account. The attack complexity is considered low, requiring network access and low privileges for successful exploitation (TYPO3 Advisory).

The vulnerability has been patched in TYPO3 versions 8.7.27 and 9.5.8. Users are advised to update to these patched versions to resolve the security issue. The fix was implemented by TYPO3 core team member Andreas Fernandez (TYPO3 Advisory).