PT-2021-23872 · Typo3 · Jobfair Extension

Nikita Hovratov · Published 2021-11-10 · Updated 2021-11-16 · CVE-2021-43564

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions jobfair extension versions prior to 1.0.13 jobfair extension versions 2.x prior to 2.0.2

Description An issue was discovered in the jobfair extension for TYPO3, where the extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files, for example, uploads/tx jobfair/cv.pdf.

Recommendations For versions prior to 1.0.13, update to version 1.0.13 or later. For versions 2.x prior to 2.0.2, update to version 2.0.2 or later. As a temporary workaround, consider restricting access to the uploads/tx jobfair directory to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-43564

GHSA-43G8-79X3-J898

Affected Products

Jobfair Extension

References · 7

• https://typo3.org/security/advisory/typo3-ext-sa-2021-018 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43564 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43564 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43g8-79x3-j898 · Vendor Advisory
• https://github.com/nhovratov/jobfair · Note
• https://t.me/cvenotify/23232 · Telegram Post
• https://t.me/cibsecurity/32168 · Telegram Post