CVEvulnerability
CVE-2010-3663
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-11-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
Affected configurations
• typo3 typo3 (< 4.1.14)
• typo3 typo3 (>= 4.2.0 < 4.2.13)
• typo3 typo3 (>= 4.3.0 < 4.3.4)
• typo3 typo3 (>= 4.4.0 < 4.4.1)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 Mailing List, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2010-3663 Third Party Advisory
- https://typo3.org/security/advisory/typo3-sa-2010-012/#Arbitrary_Code_Execution Vendor Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719 Mailing List, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2010-3663 Third Party Advisory
- https://typo3.org/security/advisory/typo3-sa-2010-012/#Arbitrary_Code_Execution Vendor Advisory