Executive brief
SYSSY is a TYPO3 extension used for monitoring and security checks on TYPO3-based websites. When the server lacks OpenSSL encryption support, the extension transmits sensitive TYPO3 system information in plaintext rather than encrypting it. An attacker who has compromised the extension's API key can intercept this sensitive data, potentially exposing critical system details that could aid in further attacks.
Technical details
The vulnerability is a cleartext transmission of sensitive information (CWE-319) in the SYSSY TYPO3 extension. When OpenSSL is unavailable on the server, the extension fails to encrypt system information before transmission, instead sending it in plaintext over the network. Exploitation requires the attacker to already possess a valid SYSSY project API key to authenticate requests. The affected versions are 3.0.5 and below. A patched version 3.0.6 is available from the TYPO3 extension manager and Packagist. The network attack vector applies, though the attacker must already have control of valid credentials (the API key).
Affected products
- SYSSY SYSSY TYPO3 Monitoring & Security Checks 3.0.5 and below
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Version 3.0.6 released