PT-2007-2509 · Typo3 · Typo3

Publicado 2007-02-22 · Atualizado 2017-07-29 · CVE-2007-1081

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 4.0.5 TYPO3 versions 4.1beta TYPO3 versions 4.1RC1

Description The issue allows attackers to inject arbitrary email headers via unknown vectors in the start function in class.t3lib formmail.php.

Recommendations For versions prior to 4.0.5, update to version 4.0.5 or later. For versions 4.1beta and 4.1RC1, avoid using the start function in class.t3lib formmail.php until a patch is available. As a temporary workaround, consider restricting access to the email functionality to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-1081

Produtos afetados

Typo3

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/32630 · Nota
• http://securityfocus.com/bid/22668 · Nota
• http://vupen.com/english/advisories/2007/0697 · Nota
• http://osvdb.org/33471 · Nota
• http://typo3.org/teams/security/security-bulletins/typo3-20070221-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1081 · Nota de Segurança
• http://secunia.com/advisories/24207 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1081 · Nota