TYPO3 allows remote authenticated backend users to unserialize arbitrary objects
view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-3527US | medium4.6 | — | ||
view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.debian.org/security/2012/dsa-2537WEB
- http://www.openwall.com/lists/oss-security/2012/08/22/8WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77791WEB
- https://github.com/TYPO3/typo3PACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2012-3527ADVISORY
- https://web.archive.org/web/20120817233148/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan