PT-2019-12516 · Typo3+3 · Typo3+3

Lauritz Holtmann · Published 2019-05-09 · Updated 2022-05-24 · CVE-2019-11832

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 8.x through 8.7.24 TYPO3 versions 9.x through 9.5.5

Description The issue allows remote code execution due to improper configuration of image processing applications, such as ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary gs must be available on the server system.

Recommendations For TYPO3 versions 8.x through 8.7.24, update to version 8.7.25 or later. For TYPO3 versions 9.x through 9.5.5, update to version 9.5.6 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

CVE-2019-11832

GHSA-3W4H-R27H-4R2W

Affected Products

Ghostscript

Graphicsmagick

Imagemagick

Typo3

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-11832.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-11832.yaml · Exploit
• https://typo3.org/security/advisory/typo3-core-sa-2019-012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11832 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3w4h-r27h-4r2w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11832 · Security Note
• https://github.com/github/advisory-database/pull/3530 · Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/e845d90b82b2f72ab12a9e37f15082297832beca · Note
• https://github.com/TYPO3/typo3/commit/51fdb774a57ee30e8d60c0e33b4a0b92d775739e · Note
• https://github.com/TYPO3/typo3/commit/2c04eeac44733fda491f92c697f88c1337d19c79 · Note
• http://securityfocus.com/bid/108305 · Note