PT-2017-14023 · Luracast+1 · Luracast Restler+1

Publicado 2017-10-15 · Atualizado 2022-05-13 · CVE-2017-15363

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Luracast Restler versions through 3.0.0 restler extension for TYPO3 versions prior to 1.7.1

Description The issue allows remote attackers to read arbitrary files via the file parameter in the public/examples/resources/getsource.php file.

Recommendations For Luracast Restler versions through 3.0.0, consider restricting access to the getsource.php file until a patch is available. For restler extension for TYPO3 versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-15363

GHSA-RVMG-XC29-RVXF

Produtos afetados

Luracast Restler

Typo3

Referências · 7

• https://github.com/AOEpeople/TYPO3_Restler/releases/tag/1.7.1 · Nota
• https://github.com/AOEpeople/TYPO3_Restler · Nota
• https://osv.dev/vulnerability/CVE-2017-15363 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15363 · Nota de Segurança
• https://extensions.typo3.org/extension/restler · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rvmg-xc29-rvxf · Aviso do Fabricante
• https://extensions.typo3.org/extension/download/restler/1.7.1/zip · Aviso do Fabricante