PT-2012-3375 · Typo3 · Typo3

Florian Weimer · Published 2012-09-04 · Updated 2022-05-17 · CVE-2012-1605

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.6.x through 4.6.6 TYPO3 version 4.7 TYPO3 version 6.0

Description The Extbase Framework in TYPO3 unserializes untrusted data, allowing remote attackers to possibly execute arbitrary code via vectors related to a missing signature for a request argument.

Recommendations For TYPO3 versions 4.6.x through 4.6.6, consider disabling the Extbase Framework until a patch is available. For TYPO3 version 4.7, restrict access to the Extbase Framework to minimize the risk of exploitation. For TYPO3 version 6.0, avoid using the Extbase Framework in untrusted environments until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2012-1605

GHSA-7JFM-PX59-99W8

Affected Products

Typo3

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2012-1605 · Security Note
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7jfm-px59-99w8 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/03/30/4 · Note
• http://securityfocus.com/bid/52771 · Note
• https://web.archive.org/web/20120527123559/http://securityfocus.com/bid/52771 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1605 · Note
• http://osvdb.org/80759 · Note