GHSA-wjpc-gjf7-9938

ghsaUSosv

TYPO3 Arbitrary Code Execution vulnerability on the backend

view advisory published 2022-04-21Licence: CC-BY-4.0

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2010-3663US	high8.8	2.40% (84th)	—	2019-11-04
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote atta…

references

External citations — patches, advisories, analysis.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719WEB
https://github.com/TYPO3-CMS/backendPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2010-3663ADVISORY
https://security-tracker.debian.org/tracker/CVE-2010-3663WEB
https://typo3.org/security/advisory/typo3-sa-2010-012/#Arbitrary_Code_ExecutionWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan