PT-2012-1342 · Typo3 · Typo3

Kurt Seifried · Published 2012-05-30 · Updated 2022-05-17 · CVE-2010-5099

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.2.x through 4.2.15 TYPO3 versions 4.3.x through 4.3.8 TYPO3 versions 4.4.x through 4.4.4

Description The issue concerns the fileDenyPattern functionality in the PHP file inclusion protection API, which fails to properly filter file types. This allows remote attackers to bypass access restrictions and access arbitrary PHP files. Attackers can exploit this using path traversal sequences with %00 null bytes to read sensitive information, such as the TYPO3 encryption key from localconf.php.

Recommendations For TYPO3 versions 4.2.x through 4.2.15, update to version 4.2.16 or later. For TYPO3 versions 4.3.x through 4.3.8, update to version 4.3.9 or later. For TYPO3 versions 4.4.x through 4.4.4, update to version 4.4.5 or later.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

CVE-2010-5099

GHSA-66J3-66CP-6C2M

Affected Products

Typo3

References · 14

• 🔥 http://exploit-db.com/exploits/15856 · Exploit
• 🔥 https://exploit-db.com/exploits/15856 · Exploit
• 🔥 http://blog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-5099 · Security Note
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66j3-66cp-6c2m · Vendor Advisory
• http://secunia.com/advisories/35770 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• http://openwall.com/lists/oss-security/2012/05/12/5 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64180 · Note
• http://openwall.com/lists/oss-security/2012/05/10/7 · Note
• https://web.archive.org/web/20120801235059/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022 · Note
• http://openwall.com/lists/oss-security/2012/05/11/3 · Note
• http://openwall.com/lists/oss-security/2011/01/13/2 · Note