PT-2012-4786 · Typo3 · Typo3

Felix Wilhelm · CVE-2012-3527 · Publicado 2012-09-05 · Atualizado 2024-01-21

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.x through 4.5.18 TYPO3 versions 4.6.x through 4.6.11 TYPO3 versions 4.7.x through 4.7.3

Description The issue allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a missing signature (HMAC).

Recommendations For versions 4.5.x through 4.5.18, update to version 4.5.19 or later. For versions 4.6.x through 4.6.11, update to version 4.6.12 or later. For versions 4.7.x through 4.7.3, update to version 4.7.4 or later.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2012-3527

DSA-2537-1

GHSA-M4HW-R893-XH4G

Produtos afetados

Typo3

Referências · 11

• https://github.com/TYPO3/typo3 · Nota
• https://osv.dev/vulnerability/GHSA-m4hw-r893-xh4g · Aviso do Fabricante
• http://osvdb.org/84773 · Nota
• https://web.archive.org/web/20120817233148/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004 · Nota
• http://secunia.com/advisories/50287 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77791 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3527 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/08/22/8 · Nota
• https://t.me/cvenotify/68152 · Publicação no Telegram
• http://debian.org/security/2012/dsa-2537 · Aviso do Fabricante
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004 · Aviso do Fabricante