PT-2017-3962 · Typo3 · Typo3

Alex Kellner + 1 · Publicado 2017-01-23 · Atualizado 2022-05-17 · CVE-2016-5091

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.3.0 through 6.2.24 TYPO3 versions 7.x through 7.6.8 TYPO3 version 8.1.1

Description The issue allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action. It is caused by deserialization problems in the Extbase extension of the TYPO3 content management system. Exploitation of the issue may allow a remote attacker to execute arbitrary code.

Recommendations For TYPO3 versions 4.3.0 through 6.2.24, update to version 6.2.24 or later. For TYPO3 versions 7.x through 7.6.8, update to version 7.6.8 or later. For TYPO3 version 8.1.1, update to a later version.

Exploit

Correção

RCE

Use of a Broken Cryptographic Algorithm

Information Disclosure

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-254

CWE-20

CWE-327

CWE-325

CWE-200

CWE-502

Identificadores relacionados

BDU:2020-04846

CVE-2016-5091

GHSA-JXG5-35FJ-CCWF

GHSA-M5VR-3M74-JWXP

Produtos afetados

Typo3

Referências · 18

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-15098.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-15098.yaml · Exploit
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxp · Nota
• https://github.com/TYPO3/TYPO3.CMS/commit/85d3e70dff35a99ef53f4b561114acfa9e5c47e1 · Nota
• https://github.com/TYPO3/TYPO3.CMS · Nota
• https://osv.dev/vulnerability/GHSA-m5vr-3m74-jwxp · Aviso do Fabricante
• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jxg5-35fj-ccwf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5091 · Nota de Segurança
• https://typo3.org/security/advisory/typo3-core-sa-2020-008 · Nota
• https://typo3.org/security/advisory/typo3-core-sa-2016-013 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-15098 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/05/26/2 · Nota
• http://openwall.com/lists/oss-security/2016/05/25/4 · Nota
• https://typo3.org/security/advisory/typo3-psa-2020-001 · Nota