GitHub Advisoryadvisory · Packagist

GHSA-7jfm-px59-99w8 Typo3 Extbase Framework Unsafe Deserialization

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-1605
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
Weaknesses
CWE-502
Reviewed
2023-08-29

Affected packages

• Packagist typo3/cms: >= 4.6, < 4.6.7 → fixed in 4.6.7 • Packagist typo3/cms: >= 4.4.0, < 4.4.14 → fixed in 4.4.14 • Packagist typo3/cms: >= 4.5.0, < 4.5.14 → fixed in 4.5.14

Description

The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."

Related

Alias · CVE (1)

  • CVE-2012-1605 The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References