PT-2012-1342 · Typo3 · Typo3

Kurt Seifried · Publicado 2012-05-30 · Atualizado 2022-05-17 · CVE-2010-5099

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.2.x through 4.2.15 TYPO3 versions 4.3.x through 4.3.8 TYPO3 versions 4.4.x through 4.4.4

Description The issue concerns the fileDenyPattern functionality in the PHP file inclusion protection API, which fails to properly filter file types. This allows remote attackers to bypass access restrictions and access arbitrary PHP files. Attackers can exploit this using path traversal sequences with %00 null bytes to read sensitive information, such as the TYPO3 encryption key from localconf.php.

Recommendations For TYPO3 versions 4.2.x through 4.2.15, update to version 4.2.16 or later. For TYPO3 versions 4.3.x through 4.3.8, update to version 4.3.9 or later. For TYPO3 versions 4.4.x through 4.4.4, update to version 4.4.5 or later.

Exploit

Correção

Path traversal

RCE

Enumeração de Fraquezas

CWE-22

CWE-20

Identificadores relacionados

CVE-2010-5099

GHSA-66J3-66CP-6C2M

Produtos afetados

Typo3

Referências · 14

• 🔥 http://exploit-db.com/exploits/15856 · Exploit
• 🔥 https://exploit-db.com/exploits/15856 · Exploit
• 🔥 http://blog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html · Exploit
• https://github.com/TYPO3/typo3 · Nota
• http://openwall.com/lists/oss-security/2012/05/12/5 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64180 · Nota
• http://openwall.com/lists/oss-security/2012/05/10/7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-5099 · Nota de Segurança
• https://web.archive.org/web/20120801235059/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022 · Nota
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/05/11/3 · Nota
• http://openwall.com/lists/oss-security/2011/01/13/2 · Nota
• https://osv.dev/vulnerability/GHSA-66j3-66cp-6c2m · Aviso do Fabricante
• http://secunia.com/advisories/35770 · Aviso do Fabricante