GitHub Advisoryadvisory · Packagist

GHSA-43g8-79x3-j898 Unrestricted access to predictable file paths in hov/jobfair

HIGH Published 2021-11-15 Modified 2021-11-17 Official page ↗
Aliases
CVE-2021-43564
Ecosystem
Packagist
Packages
hov/jobfair
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2021-11-12

Affected packages

• Packagist hov/jobfair: < 1.0.13 → fixed in 1.0.13 • Packagist hov/jobfair: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).

Related

Alias · CVE (1)

  • CVE-2021-43564 An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References