GitHub Advisoryadvisory · Packagist

GHSA-2rxh-h6h9-qrqc Class destructors causing side-effects when being unserialized in TYPO3 CMS

HIGH Published 2020-05-13 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-11066
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Weaknesses
CWE-1321, CWE-915
Reviewed
2020-05-13

Affected packages

• Packagist typo3/cms-core: >= 9.0.0, < 9.5.17 → fixed in 9.5.17 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.2 → fixed in 10.4.2 • Packagist typo3/cms: >= 10.0.0, < 10.4.2 → fixed in 10.4.2 • Packagist typo3/cms: >= 9.0.0, < 9.5.17 → fixed in 9.5.17

Description

Calling unserialize() on malicious user-submitted content can result in the following scenarios: • trigger deletion of arbitrary directory in file system (if writable for web server) • trigger message submission via email using identity of web site (mail relay) Another insecure deserialization vulnerability is required to actually exploit mentioned aspects. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References • https://typo3.org/security/advisory/typo3-core-sa-2020-004

Related

Alias · CVE (1)

  • CVE-2020-11066 In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References