PT-2014-5622 · Typo3 · Typo3

Helmut Hummel · Publicado 2014-06-03 · Atualizado 2022-05-14 · CVE-2014-3942

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.0 through 4.5.33 TYPO3 versions 4.7.0 through 4.7.18 TYPO3 versions 6.0.0 through 6.0.13 TYPO3 versions 6.1.0 through 6.1.8

Description The issue allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object. This is related to the Color Picker Wizard component.

Recommendations For TYPO3 versions 4.5.0 through 4.5.33, update to version 4.5.34 or later. For TYPO3 versions 4.7.0 through 4.7.18, update to version 4.7.19 or later. For TYPO3 versions 6.0.0 through 6.0.13, update to version 6.0.14 or later. For TYPO3 versions 6.1.0 through 6.1.8, update to version 6.1.9 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-3942

DSA-2942-1

GHSA-55G3-FJWM-W2C8

Produtos afetados

Typo3

Referências · 8

• https://github.com/TYPO3/typo3 · Nota
• http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/06/03/2 · Nota
• https://osv.dev/vulnerability/GHSA-55g3-fjwm-w2c8 · Aviso do Fabricante
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Aviso do Fabricante
• https://typo3.org/security/advisory/typo3-core-sa-2014-001 · Nota
• http://debian.org/security/2014/dsa-2942 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3942 · Nota de Segurança