CVEvulnerability

CVE-2012-3527

4.6 MEDIUM Published 2012-09-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-09-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:N/AC:H/Au:S/C:P/I:P/A:P
Weaknesses
CWE-502

Description

view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."

Affected configurations

• typo3 typo3 (>= 4.5.0 < 4.5.19) • typo3 typo3 (>= 4.6.0 < 4.6.12) • typo3 typo3 (>= 4.7.0 < 4.7.4) • debian debian linux 6.0 • debian debian linux 7.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

Referenced by CWE · observed example (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References