Vulnerability advisory

GHSA-55g3-fjwm-w2c8

TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

Published May 14, 2022Updated Apr 14, 2025OSV record ↗

Also known as CVE-2014-3942

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected versions

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`4.5.0` to before 4.5.34	`4.5.34`Advisories →
`4.7.0` to before 4.7.19	`4.7.19`Advisories →
`6.0.0` to before 6.0.14	`6.0.14`Advisories →
`6.1.0` to before 6.1.9	`6.1.9`Advisories →

Description

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2014-3942 ↗
Packagegithub.com/TYPO3/typo3 ↗
Webtypo3.org/security/advisory/typo3-core-sa-2014-001 ↗
Weblists.opensuse.org/opensuse-updates/2014-06/msg00037.html ↗
Webwww.debian.org/security/2014/dsa-2942 ↗
Webwww.openwall.com/lists/oss-security/2014/06/03/2 ↗