GitHub Advisoryadvisory · Packagist

GHSA-47ww-mq32-g4xw TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2013-7075
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-502
Reviewed
2023-08-29

Affected packages

• Packagist typo3/cms: >= 4.5.0, < 4.5.32 → fixed in 4.5.32 • Packagist typo3/cms: >= 4.7.0, < 4.7.17 → fixed in 4.7.17 • Packagist typo3/cms: >= 6.0.0, < 6.0.12 → fixed in 6.0.12 • Packagist typo3/cms: >= 6.1.0, < 6.1.7 → fixed in 6.1.7

Description

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."

Related

Alias · CVE (1)

  • CVE-2013-7075 The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References