Vulnerability advisory
GHSA-p9jg-9w87-6rg4
TYPO3 Improper Access Management in the File Abstraction Layer
Also known as CVE-2013-4320
Severity
Severity not reported.
Affected versions
| Affected | Fixed in |
|---|---|
6.0 to before 6.0.9 | 6.0.9Advisories → |
6.1 to before 6.1.4 | 6.1.4Advisories → |
Description
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.