PT-2017-4834 · Typo3 · Typo3/Cms

Helmut Hummel + 1 · Publicado 2017-10-20 · Atualizado 2022-05-17 · CVE-2010-3659

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 4.1.x through 4.1.13 TYPO3 CMS versions 4.2.x through 4.2.12 TYPO3 CMS versions 4.3.x through 4.3.3 TYPO3 CMS versions 4.4.x through 4.4.0

Description: The issue allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager or unspecified parameters to unknown backend forms.

Recommendations: For versions 4.1.x through 4.1.13, update to version 4.1.14 or later. For versions 4.2.x through 4.2.12, update to version 4.2.13 or later. For versions 4.3.x through 4.3.3, update to version 4.3.4 or later. For versions 4.4.x through 4.4.0, update to version 4.4.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-3659

DSA-2098-1

GHSA-JR79-65XR-Q7CX

Produtos afetados

Typo3/Cms

Referências · 10

• https://github.com/TYPO3-CMS/backend · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-3659 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-3659 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-jr79-65xr-q7cx · Aviso do Fabricante
• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-012 · Aviso do Fabricante
• https://web.archive.org/web/20120903133822/http://securityfocus.com/bid/42029 · Nota
• http://securityfocus.com/bid/42029 · Nota
• http://openwall.com/lists/oss-security/2010/09/28/8 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3659 · Nota
• http://openwall.com/lists/oss-security/2014/02/12/8 · Nota