DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
TYPO3 Core und TYPO3 Extension: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-02-12
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.
01
beschreibt (7)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-22188US | — | — | ||
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command… | ||||
| CVE-2024-25121US | high7.1 | — | ||
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be pers… | ||||
| CVE-2024-25120US | medium4.3 | — | ||
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the u… | ||||
| CVE-2024-25119US | medium4.9 | — | ||
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing f… | ||||
| CVE-2024-25118US | medium6.5 | — | ||
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user inte… | ||||
| CVE-2024-24751US | high8.8OT erhöht | — | ||
sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in th… | ||||
| CVE-2023-30451US | medium4.9 | — | ||
In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demo… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- TYPO3 13.0.1, 12.4.11 and 11.5.35 Security Release vom 2024-02-12external
- Typo3 Security Advisory vom 2024-02-12external
- Typo3 Security Advisory vom 2024-02-12external
- Typo3 Security Advisory vom 2024-02-12external
- Typo3 Security Advisory vom 2024-02-12external
- Typo3 Security Advisory vom 2024-02-12external
- Typo3 Security Advisory vom 2024-02-12external
- Typo3 Security Advisory vom 2024-02-12external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan