PT-2013-6256 · Typo3+1 · Typo3+1

Georg Ringer · Published 2013-12-23 · Updated 2022-05-17 · CVE-2013-7073

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.0 through 4.5.31 TYPO3 versions 4.7.0 through 4.7.16 TYPO3 versions 6.0.0 through 6.0.11 TYPO3 versions 6.1.0 through 6.1.6

Description The issue concerns the Content Editing Wizards component, which fails to check permissions. This allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.

Recommendations For versions 4.5.0 through 4.5.31, update to a version that includes the necessary permission checks. For versions 4.7.0 through 4.7.16, update to a version that includes the necessary permission checks. For versions 6.0.0 through 6.0.11, update to a version that includes the necessary permission checks. For versions 6.1.0 through 6.1.6, update to a version that includes the necessary permission checks.

Fix

Information Disclosure

Weakness Enumeration

CWE-264

CWE-200

Related Identifiers

CVE-2013-7073

DSA-2834-1

GHSA-4RPV-G4GQ-RH4M

OPENSUSE-SU-2016_2025-1

Affected Products

Suse

Typo3

References · 14

• https://ubuntu.com/security/CVE-2013-7073 · Vendor Advisory
• http://debian.org/security/2014/dsa-2834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7073 · Security Note
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html · Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-7073 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7073 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4rpv-g4gq-rh4m · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• http://seclists.org/oss-sec/2013/q4/487 · Note
• http://seclists.org/oss-sec/2013/q4/473 · Note
• http://openwall.com/lists/oss-security/2013/12/12 · Note