GitHub Advisoryadvisory · Packagist

GHSA-598p-rv6p-g7qc sr_freecap for Typo3 RCE Vulnerability

CRITICAL Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-16699
Ecosystem
Packagist
Packages
sjbr/sr-freecap
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-07-18

Affected packages

• Packagist sjbr/sr-freecap: >= 2.5.0, < 2.5.3 → fixed in 2.5.3 • Packagist sjbr/sr-freecap: < 2.4.6 → fixed in 2.4.6

Description

The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.

Related

Alias · CVE (1)

  • CVE-2019-16699 The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References