GitHub Advisoryadvisory · Packagist

GHSA-p9jg-9w87-6rg4 TYPO3 Improper Access Management in the File Abstraction Layer

MEDIUM Published 2022-05-17 Modified 2023-08-28 Official page ↗
Aliases
CVE-2013-4320
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2023-08-28

Affected packages

• Packagist typo3/cms-core: >= 6.0, < 6.0.9 → fixed in 6.0.9 • Packagist typo3/cms-core: >= 6.1, < 6.1.4 → fixed in 6.1.4

Description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

Related

Alias · CVE (1)

  • CVE-2013-4320 The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References