Vulnerability advisory
GHSA-wjpc-gjf7-9938
TYPO3 Arbitrary Code Execution vulnerability on the backend
Also known as CVE-2010-3663
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 4.1.14 | 4.1.14Advisories → |
4.2 to before 4.2.13 | 4.2.13Advisories → |
4.3 to before 4.3.4 | 4.3.4Advisories → |
4.4 to before 4.4.1 | 4.4.1Advisories → |
Description
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.