CVEvulnerability
CVE-2019-16700
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-10-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.
Affected configurations
• slub-dresden slub events (<= 3.0.2)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://extensions.typo3.org/extension/slub_events Third Party Advisory
- https://typo3.org/security/advisory/typo3-ext-sa-2019-017/ Third Party Advisory
- https://extensions.typo3.org/extension/slub_events Third Party Advisory
- https://typo3.org/security/advisory/typo3-ext-sa-2019-017/ Third Party Advisory