GitHub Advisoryadvisory · Packagist
GHSA-3w4h-r27h-4r2w TYPO3 Image Processing susceptible to Code Execution
HIGH
Official page ↗
- Aliases
- CVE-2019-11832
- Ecosystem
- Packagist
- Packages
- typo3/cms-core, typo3/cms
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20, CWE-94
- Reviewed
- 2024-02-20
Affected packages
• Packagist typo3/cms-core: >= 8.0.0, < 8.7.25 → fixed in 8.7.25
• Packagist typo3/cms-core: >= 9.0.0, < 9.5.6 → fixed in 9.5.6
• Packagist typo3/cms: >= 8.0.0, < 8.7.25 → fixed in 8.7.25
• Packagist typo3/cms: >= 9.0.0, < 9.5.6 → fixed in 9.5.6
Description
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
For a successful exploit, the GhostScript binary `gs` must be available on the server system.
Related
Alias · CVE (1)
- CVE-2019-11832 TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-11832 advisory
- https://github.com/github/advisory-database/pull/3530 web
- https://github.com/TYPO3/typo3/commit/2c04eeac44733fda491f92c697f88c1337d19c79 web
- https://github.com/TYPO3/typo3/commit/51fdb774a57ee30e8d60c0e33b4a0b92d775739e web
- https://github.com/TYPO3/typo3/commit/e845d90b82b2f72ab12a9e37f15082297832beca web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-11832.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-11832.yaml web
- https://github.com/TYPO3/typo3 package
- https://typo3.org/security/advisory/typo3-core-sa-2019-012 web