GitHub Advisoryadvisory · Packagist

GHSA-74w6-ww7w-45j9 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection

HIGH Published 2022-05-02 Modified 2024-01-23 Official page ↗
Aliases
CVE-2009-0258
Ecosystem
Packagist
Packages
typo3/cms
Severity
High
Weaknesses
CWE-20, CWE-78
Reviewed
2024-01-23

Affected packages

• Packagist typo3/cms: >= 4.0.0, < 4.0.10 → fixed in 4.0.10 • Packagist typo3/cms: >= 4.1.0, < 4.1.8 → fixed in 4.1.8 • Packagist typo3/cms: >= 4.2.0, < 4.2.4 → fixed in 4.2.4

Description

The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.

Related

Alias · CVE (1)

  • CVE-2009-0258 The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References