Vulnerability advisory
GHSA-m76j-69c2-c3m8
TYPO3 vulnerable to remote authenticated arbitrary code execution
Also known as CVE-2013-4321
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected versions
typo3/cms Packagist
All typo3/cms advisories →| Affected | Fixed in |
|---|---|
6.0.0 to before 6.0.9 | 6.0.9Advisories → |
6.1.0 to before 6.1.4 | 6.1.4Advisories → |
Description
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.