Vulnerability advisory
GHSA-7jfm-px59-99w8
Typo3 Extbase Framework Unsafe Deserialization
Also known as CVE-2012-1605
Severity
Severity not reported.
Affected versions
typo3/cms Packagist
All typo3/cms advisories →| Affected | Fixed in |
|---|---|
4.6 to before 4.6.7 | 4.6.7Advisories → |
4.4.0 to before 4.4.14 | 4.4.14Advisories → |
4.5.0 to before 4.5.14 | 4.5.14Advisories → |
Description
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."