Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/TYPO3/typo3 ↗ | |
| 41235ff8e38c6f3401df03ae8beddd62d662c525 through 1fc9f156fa3783e1f3327afa2ec772b8253c379f | No fix listed |
| c91b70e450c52d29ffb08115fffbb7832b15a330 through d54b7fc011b9b9d4ecea8196b59fe919c2c09406 | No fix listed |
Also listed as affected (28)
| |
| GIT github.com/typo3/typo3 ↗ | |
| 41235ff8e38c6f3401df03ae8beddd62d662c525 through 1fc9f156fa3783e1f3327afa2ec772b8253c379f | No fix listed |
| c91b70e450c52d29ffb08115fffbb7832b15a330 through d54b7fc011b9b9d4ecea8196b59fe919c2c09406 | No fix listed |
Also listed as affected (28)
| |
Description
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.