PT-2012-3375 · Typo3 · Typo3

Florian Weimer · Publicado 2012-09-04 · Atualizado 2022-05-17 · CVE-2012-1605

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.6.x through 4.6.6 TYPO3 version 4.7 TYPO3 version 6.0

Description The Extbase Framework in TYPO3 unserializes untrusted data, allowing remote attackers to possibly execute arbitrary code via vectors related to a missing signature for a request argument.

Recommendations For TYPO3 versions 4.6.x through 4.6.6, consider disabling the Extbase Framework until a patch is available. For TYPO3 version 4.7, restrict access to the Extbase Framework to minimize the risk of exploitation. For TYPO3 version 6.0, avoid using the Extbase Framework in untrusted environments until the issue is resolved.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2012-1605

GHSA-7JFM-PX59-99W8

Produtos afetados

Typo3

Referências · 8

• http://openwall.com/lists/oss-security/2012/03/30/4 · Nota
• http://securityfocus.com/bid/52771 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1605 · Nota de Segurança
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 · Aviso do Fabricante
• https://web.archive.org/web/20120527123559/http://securityfocus.com/bid/52771 · Nota
• https://osv.dev/vulnerability/GHSA-7jfm-px59-99w8 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1605 · Nota
• http://osvdb.org/80759 · Nota