GitHub Advisoryadvisory · Packagist

GHSA-m4hw-r893-xh4g TYPO3 allows remote authenticated backend users to unserialize arbitrary objects

MEDIUM Published 2022-05-17 Modified 2025-04-12 Official page ↗
Aliases
CVE-2012-3527
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
Weaknesses
CWE-502
Reviewed
2025-04-12

Affected packages

• Packagist typo3/cms: >= 4.5.0, < 4.5.19 → fixed in 4.5.19 • Packagist typo3/cms: >= 4.6.0, < 4.6.12 → fixed in 4.6.12 • Packagist typo3/cms: >= 4.7.0, < 4.7.4 → fixed in 4.7.4

Description

view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."

Related

Alias · CVE (1)

  • CVE-2012-3527 view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References