PT-2019-12516 · Typo3+3 · Typo3+3

Lauritz Holtmann · Publicado 2019-05-09 · Atualizado 2022-05-24 · CVE-2019-11832

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 8.x through 8.7.24 TYPO3 versions 9.x through 9.5.5

Description The issue allows remote code execution due to improper configuration of image processing applications, such as ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary gs must be available on the server system.

Recommendations For TYPO3 versions 8.x through 8.7.24, update to version 8.7.25 or later. For TYPO3 versions 9.x through 9.5.5, update to version 9.5.6 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-20

CWE-94

Identificadores relacionados

CVE-2019-11832

GHSA-3W4H-R27H-4R2W

Produtos afetados

Ghostscript

Graphicsmagick

Imagemagick

Typo3

Referências · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-11832.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-11832.yaml · Exploit
• https://github.com/github/advisory-database/pull/3530 · Nota
• https://github.com/TYPO3/typo3 · Nota
• https://github.com/TYPO3/typo3/commit/e845d90b82b2f72ab12a9e37f15082297832beca · Nota
• https://github.com/TYPO3/typo3/commit/51fdb774a57ee30e8d60c0e33b4a0b92d775739e · Nota
• https://github.com/TYPO3/typo3/commit/2c04eeac44733fda491f92c697f88c1337d19c79 · Nota
• http://securityfocus.com/bid/108305 · Nota
• https://typo3.org/security/advisory/typo3-core-sa-2019-012 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11832 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3w4h-r27h-4r2w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11832 · Nota de Segurança