PT-2025-22370 · Typo3 · Ns Backup

CVE-2025-48201 · Publicado 2025-05-20 · Atualizado 2025-12-27

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ns backup extension for TYPO3 version 13.0.0 and earlier

Description The issue concerns a Predictable Resource Location in the ns backup extension for TYPO3. This allows an unauthenticated remote user to download created backups and configuration files.

Recommendations For versions 13.0.0 and earlier, consider disabling the ns backup extension until a patch is available to prevent unauthenticated access to backups and configuration files.

Exploit

Correção

Enumeração de Fraquezas

CWE-425

Identificadores relacionados

BDU:2025-05994

CVE-2025-48201

GHSA-HQ4F-5QJV-FWRG

Produtos afetados

Ns Backup

Referências · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/nitsan/ns-backup/CVE-2025-48201.yaml · Exploit
• https://t.me/latest_high_impact_cve/2434 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2005031811852677203 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-05994 · Nota de Segurança
• https://github.com/nitsan-technologies/ns_backup · Nota
• https://osv.dev/vulnerability/GHSA-hq4f-5qjv-fwrg · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/1925215121715974153 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-48201 · Nota de Segurança
• https://t.me/cvetracker/24382 · Publicação no Telegram
• https://typo3.org/security/advisory/typo3-ext-sa-2025-007 · Nota
• https://github.com/nitsan-technologies/ns_backup/commit/67b8102a19e8e516dc4228f5c42f9e4fba5046cb · Nota