GHSA-gwfx-p7mr-f92v Missing Access Check in TYPO3 CMS

• Packagist typo3/cms: >= 6.2.0, < 6.2.25 → fixed in 6.2.25 • Packagist typo3/cms: >= 7.6.0, < 7.6.8 → fixed in 7.6.8 • Packagist typo3/cms: >= 8.0.0, < 8.1.1 → fixed in 8.1.1

Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.