PT-2012-1930 · Typo3 · Typo3

Björn Pedersen + 1 · Published 2012-02-18 · Updated 2012-02-29 · CVE-2011-4614

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.x through 4.5.8 TYPO3 versions 4.6.x through 4.6.1 TYPO3 development versions of 4.7

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the BACK PATH parameter. This is a result of a PHP remote file inclusion vulnerability in the workspaces system extension, specifically in Classes/Controller/AbstractController.php.

Recommendations For TYPO3 versions 4.5.x through 4.5.8, update to version 4.5.9 or later. For TYPO3 versions 4.6.x through 4.6.1, update to version 4.6.2 or later. For TYPO3 development versions of 4.7, consider avoiding the use of the BACK PATH parameter until a fixed version is available. As a temporary workaround, consider restricting access to the affected AbstractController.php file in the workspaces system extension.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-4614

Affected Products

Typo3

References · 8

• 🔥 https://exploit-db.com/exploits/18308 · Exploit
• http://secunia.com/advisories/47201 · Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4614 · Security Note
• http://openwall.com/lists/oss-security/2011/12/16/1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4614 · Note
• http://typo3.org/fileadmin/security-team/bug32571/32571.diff · Note
• http://osvdb.org/77776 · Note