CVE-2009-3628: The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x b...

Security readout for executives and security teams

CVE-2009-3628 is an authenticated information disclosure issue in TYPO3 Backend. A logged-in remote user could use crafted input in a tt_content form element to determine an encryption key. The business risk depends on whether affected legacy TYPO3 systems are still reachable and who has backend access. Exposure is most likely on legacy TYPO3 installations in the listed versions with reachable Backend access and valid authenticated users. Systems not running TYPO3, not using these branches, or without backend access exposure are less likely affected based on the provided sources. Treat this as a legacy-platform exposure issue. It is not cited as actively exploited, but disclosure of an encryption key can materially weaken application security if old TYPO3 Backend systems remain accessible to authenticated users. Mitigation focus: Identify any TYPO3 4.0.x, 4.1.x, 4.2.x, or 4.3 beta installations.; Upgrade affected 4.1.x, 4.2.x, and 4.3.x systems to vendor-fixed versions or later.; For TYPO3 4.0.13 or earlier, follow TYPO3-SA-2009-016 vendor guidance..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.