GHSA-5fj8-wh3g-qvq2

ghsaUSosv

TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

view advisory published 2022-05-17Licence: CC-BY-4.0

The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted links, aka "Mass Assignment."

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2013-7080US	medium5.8	1.21% (68th)	—	2013-12-23
The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allo…

references

External citations — patches, advisories, analysis.

http://seclists.org/oss-sec/2013/q4/473WEB
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004WEB
http://www.debian.org/security/2014/dsa-2834WEB
https://github.com/TYPO3-CMS/corePACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2013-7080ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan