GitHub Advisoryadvisory · Packagist

GHSA-55g3-fjwm-w2c8 TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

HIGH Published 2022-05-14 Modified 2025-04-14 Official page ↗
Aliases
CVE-2014-3942
Ecosystem
Packagist
Packages
typo3/cms
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-94
Reviewed
2025-04-14

Affected packages

• Packagist typo3/cms: >= 4.5.0, < 4.5.34 → fixed in 4.5.34 • Packagist typo3/cms: >= 4.7.0, < 4.7.19 → fixed in 4.7.19 • Packagist typo3/cms: >= 6.0.0, < 6.0.14 → fixed in 6.0.14 • Packagist typo3/cms: >= 6.1.0, < 6.1.9 → fixed in 6.1.9

Description

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

Related

Alias · CVE (1)

  • CVE-2014-3942 The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References