PT-2015-6634 · Typo3 · Typo3 Frontend User Upload (Feupload) Extension

Torben Hansen · Publicado 2015-06-16 · Atualizado 2016-12-07 · CVE-2015-4607

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 Frontend User Upload (feupload) extension version 0.5.0 and earlier

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the fileadmin folder.

Recommendations For versions 0.5.0 and earlier, consider disabling the file upload functionality in the Frontend User Upload (feupload) extension until a patch is available. Restrict access to the fileadmin folder to minimize the risk of exploitation. Avoid using executable file extensions in uploads to prevent arbitrary code execution.

Correção

Identificadores relacionados

CVE-2015-4607

Produtos afetados

Typo3 Frontend User Upload (Feupload) Extension

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-4607 · Nota de Segurança
• http://securityfocus.com/bid/75248 · Nota
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-006 · Aviso do Fabricante