GHSA-p9jg-9w87-6rg4

ghsaUSosv

TYPO3 Improper Access Management in the File Abstraction Layer

view advisory published 2022-05-17Licence: CC-BY-4.0

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2013-4320US	medium5.5	0.98% (62nd)	—	2014-05-20
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read a…

references

External citations — patches, advisories, analysis.

https://github.com/TYPO3-CMS/corePACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2013-4320ADVISORY
https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan