GitHub Advisoryadvisory · Packagist

GHSA-5pww-3mfc-g8vr slub_events for Typo3 Arbitrary File Upload

CRITICAL Published 2022-05-24 Modified 2023-08-01 Official page ↗
Aliases
CVE-2019-16700
Ecosystem
Packagist
Packages
slub/slub-events
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-08-01

Affected packages

• Packagist slub/slub-events: < 3.0.3 → fixed in 3.0.3

Description

The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.

Related

Alias · CVE (1)

  • CVE-2019-16700 The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References