GHSA-qf79-34j4-54m6

ghsaUSosv

Typo3 Improper Access Control

view advisory published 2022-04-22Licence: CC-BY-4.0

TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2011-4904US	medium6.5	1.14% (66th)	—	2019-11-06
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.

references

External citations — patches, advisories, analysis.

https://github.com/TYPO3/typo3PACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2011-4904ADVISORY
https://security-tracker.debian.org/tracker/CVE-2011-4904WEB
https://typo3.org/security/advisory/typo3-core-sa-2011-001/#Missing_Access_ControlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan