PT-2013-6256 · Typo3+1 · Typo3+1

Georg Ringer · Publicado 2013-12-23 · Atualizado 2022-05-17 · CVE-2013-7073

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.0 through 4.5.31 TYPO3 versions 4.7.0 through 4.7.16 TYPO3 versions 6.0.0 through 6.0.11 TYPO3 versions 6.1.0 through 6.1.6

Description The issue concerns the Content Editing Wizards component, which fails to check permissions. This allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.

Recommendations For versions 4.5.0 through 4.5.31, update to a version that includes the necessary permission checks. For versions 4.7.0 through 4.7.16, update to a version that includes the necessary permission checks. For versions 6.0.0 through 6.0.11, update to a version that includes the necessary permission checks. For versions 6.1.0 through 6.1.6, update to a version that includes the necessary permission checks.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-264

CWE-200

Identificadores relacionados

CVE-2013-7073

DSA-2834-1

GHSA-4RPV-G4GQ-RH4M

OPENSUSE-SU-2016_2025-1

Produtos afetados

Suse

Typo3

Referências · 14

• https://github.com/TYPO3/typo3 · Nota
• https://ubuntu.com/security/CVE-2013-7073 · Aviso do Fabricante
• http://debian.org/security/2014/dsa-2834 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-7073 · Nota de Segurança
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html · Aviso do Fabricante
• http://seclists.org/oss-sec/2013/q4/487 · Nota
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-7073 · Nota de Segurança
• http://seclists.org/oss-sec/2013/q4/473 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7073 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/12/12 · Nota
• https://osv.dev/vulnerability/GHSA-4rpv-g4gq-rh4m · Aviso do Fabricante