CVEvulnerability
CVE-2008-2717
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-06-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
Affected configurations
• apache apache webserver
• typo3 typo3 4.0
• typo3 typo3 4.0.1
• typo3 typo3 4.0.2
• typo3 typo3 4.0.3
• typo3 typo3 4.0.4
• typo3 typo3 4.0.5
• typo3 typo3 4.0.6
• typo3 typo3 4.0.7
• typo3 typo3 4.0.8
• typo3 typo3 4.1
• typo3 typo3 4.1.1
• typo3 typo3 4.1.2
• typo3 typo3 4.1.3
• typo3 typo3 4.1.4
• typo3 typo3 4.1.5
• typo3 typo3 4.1.6
• typo3 typo3 4.2
Related
Weakness · not in database (1)
References
- http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/ buzz.typo3.org
- http://secunia.com/advisories/30619 Vendor Advisory
- http://secunia.com/advisories/30660 Vendor Advisory
- http://securityreason.com/securityalert/3945 securityreason.com
- http://typo3.org/teams/security/security-bulletins/typo3-20080611-1/ typo3.org
- http://www.debian.org/security/2008/dsa-1596 www.debian.org
- http://www.securityfocus.com/archive/1/493270/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/29657 www.securityfocus.com
- http://www.vupen.com/english/advisories/2008/1802 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42988 exchange.xforce.ibmcloud.com
- http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/ buzz.typo3.org
- http://secunia.com/advisories/30619 Vendor Advisory
- http://secunia.com/advisories/30660 Vendor Advisory
- http://securityreason.com/securityalert/3945 securityreason.com
- http://typo3.org/teams/security/security-bulletins/typo3-20080611-1/ typo3.org
- http://www.debian.org/security/2008/dsa-1596 www.debian.org
- http://www.securityfocus.com/archive/1/493270/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/29657 www.securityfocus.com
- http://www.vupen.com/english/advisories/2008/1802 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42988 exchange.xforce.ibmcloud.com