Vulnerability advisory

GHSA-3w4h-r27h-4r2w

TYPO3 Image Processing susceptible to Code Execution

Published May 24, 2022Updated Feb 20, 2024OSV record ↗

Also known as CVE-2019-11832

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`8.0.0` to before 8.7.25	`8.7.25`Advisories →
Also listed as affected (18) `v8.7.10` `v8.7.11` `v8.7.12` `v8.7.13` `v8.7.14` `v8.7.15` `v8.7.16` `v8.7.17` `v8.7.18` `v8.7.19` `v8.7.20` `v8.7.21` `v8.7.22` `v8.7.23` `v8.7.24` `v8.7.7` `v8.7.8` `v8.7.9`
`9.0.0` to before 9.5.6	`9.5.6`Advisories →
Also listed as affected (15) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5`

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`8.0.0` to before 8.7.25	`8.7.25`Advisories →
Also listed as affected (40) `8.0.0` `8.0.1` `8.1.0` `8.1.1` `8.1.2` `8.2.0` `8.2.1` `8.3.0` `8.3.1` `8.4.0` `8.4.1` `8.5.0` `8.5.1` `8.6.0` `8.6.1` `8.7.0` `8.7.1` `8.7.2` `v8.7.10` `v8.7.11` `v8.7.12` `v8.7.13` `v8.7.14` `v8.7.15` `v8.7.16` `v8.7.17` `v8.7.18` `v8.7.19` `v8.7.20` `v8.7.21` `v8.7.22` `v8.7.23` `v8.7.24` `v8.7.3` `v8.7.4` `v8.7.5` `v8.7.6` `v8.7.7` `v8.7.8` `v8.7.9`
`9.0.0` to before 9.5.6	`9.5.6`Advisories →
Also listed as affected (15) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5`

Description

TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary gs must be available on the server system.

GHSA-3w4h-r27h-4r2w

Affected versions

typo3/cms-core Packagist

typo3/cms Packagist

Description

References