TYPO3 Image Processing susceptible to Code Execution
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary `gs` must be available on the server system.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-11832US | high7.5 | — | ||
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by Imag… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-11832.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-11832.yamlWEB
- https://github.com/TYPO3/typo3PACKAGE
- https://github.com/TYPO3/typo3/commit/2c04eeac44733fda491f92c697f88c1337d19c79WEB
- https://github.com/TYPO3/typo3/commit/51fdb774a57ee30e8d60c0e33b4a0b92d775739eWEB
- https://github.com/TYPO3/typo3/commit/e845d90b82b2f72ab12a9e37f15082297832becaWEB
- https://github.com/github/advisory-database/pull/3530WEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-11832ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan