GitHub Advisoryadvisory · Packagist
GHSA-4r76-xr68-w7m7 TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
HIGH
Official page ↗
- Ecosystem
- Packagist
- Packages
- typo3/cms
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-269
- Reviewed
- 2024-05-30
Affected packages
• Packagist typo3/cms: >= 6.2.0, < 6.2.14 → fixed in 6.2.14
• Packagist typo3/cms: >= 7.0.0, < 7.3.1 → fixed in 7.3.1
Description
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://github.com/TYPO3/typo3/commit/0decbf83c531cab77497429eb2edecf9a1038b25 web
- https://github.com/TYPO3/typo3/commit/bff9fa5945801d1d2c641ddc8eb86c6647549d80 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-07-01-1.yaml web
- https://github.com/TYPO3/typo3 package
- https://typo3.org/security/advisory/typo3-core-sa-2015-002 web
- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002 web