DemoBook a demo

Vulnerability advisory

CVE-2019-11831

Published Updated OSV record ↗

Also known as DRUPAL-CORE-2019-007GHSA-xv7v-rf6g-xwrc

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before 09a33aa82ad15d5179322199f694f1fa7e6fb3e209a33aa82ad15d5179322199f694f1fa7e6fb3e2
9b04d294324d9c76be4b596de4316cb8804e8223 to before 9d60ac244d73ffd69d651f52d8642307c22f633a9d60ac244d73ffd69d651f52d8642307c22f633a
17ba30046ed57677de4feff8d07354890b40efdb to before 553207a347f92dce802d7ea9e4d9602c5b090775553207a347f92dce802d7ea9e4d9602c5b090775
Also listed as affected (43)
  • 7.66
  • 8.6.15
  • 8.7.0
  • 7.65
  • 8.6.14
  • 7.64
  • 8.6.12
  • 8.6.11
  • 8.6.9
  • 8.6.8
  • 7.61
  • 8.6.5
  • 8.6.4
  • 8.6.3
  • 8.6.1
  • 8.6.0
  • 7.56
  • 7.55
  • 7.54
  • 7.51
  • 7.50
  • 7.43
  • 7.42
  • 7.40
  • 7.37
  • 7.36
  • 7.33
  • 7.30
  • 7.28
  • 7.25
  • 7.23
  • 7.22
  • 7.17
  • 7.15
  • 7.14
  • 7.12
  • 7.10
  • 7.9
  • 7.8
  • 7.7
  • 7.6
  • 7.4
  • 7.0
GIT github.com/joomla/joomla-cms ↗
8fdbcb163040ff7b8fd12fb27bbfae76816bdad3 through 1547f8e76000a22d9befc2551ca9929f5d2d0c56No fix listed
Also listed as affected (5)
  • 3.9.5
  • 3.9.4
  • 3.9.3
  • 3.9.5-rc
  • 3.9.4-rc
GIT github.com/typo3/phar-stream-wrapper ↗
369f83042ea2e57d98dd04ce4c7318d008497a29 to before e438b0c78652b33407983eb29d215a1a3f68f6f3e438b0c78652b33407983eb29d215a1a3f68f6f3
072007eb3d2c8864aa7535fe5bd0349b5ba765f6 to before fff6f5e037882f816cd41a9f5ccd8d8f97bfdebffff6f5e037882f816cd41a9f5ccd8d8f97bfdebf
Also listed as affected (7)
  • v2.1.0
  • v.2.1.0
  • v3.1.0
  • v2.0.1
  • v3.0.1
  • v2.0.0
  • v3.0.0

Description

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.