GitHub Advisoryadvisory · Packagist

GHSA-5fj8-wh3g-qvq2 TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2013-7080
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
Moderate
Reviewed
2023-08-29

Affected packages

• Packagist typo3/cms-core: >= 4.5.0, < 4.5.31 → fixed in 4.5.31 • Packagist typo3/cms-core: >= 4.6.0, < 4.7.16 → fixed in 4.7.16 • Packagist typo3/cms-core: >= 6.0.0, < 6.0.11 → fixed in 6.0.11

Description

The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted links, aka "Mass Assignment."

Related

Alias · CVE (1)

  • CVE-2013-7080 The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0… vulnerability

References