PT-2021-23871 · Typo3 · Pixxio Extension

Alexander Sidukov + 4 · Published 2021-11-10 · Updated 2022-07-12 · CVE-2021-43563

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pixxio extension versions prior to 1.0.6 for TYPO3

Description The Access Control in the bundled media browser of the pixxio extension is broken. This allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user, enabling the download of various media files from the DAM system.

Recommendations For versions prior to 1.0.6, update to version 1.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the bundled media browser to prevent unauthorized requests to the pixx.io API.

Fix

Related Identifiers

CVE-2021-43563

Affected Products

Pixxio Extension

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-43563 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43563 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-ext-sa-2021-017 · Patch
• https://t.me/cibsecurity/32169 · Telegram Post
• https://t.me/cvenotify/23233 · Telegram Post