GitHub Advisoryadvisory · Packagist

GHSA-qf79-34j4-54m6 Typo3 Improper Access Control

MEDIUM Published 2022-04-22 Modified 2024-01-12 Official page ↗
Aliases
CVE-2011-4904
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20
Reviewed
2024-01-12

Affected packages

• Packagist typo3/cms: < 4.4.9 → fixed in 4.4.9 • Packagist typo3/cms: >= 4.5.0, < 4.5.4 → fixed in 4.5.4

Description

TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.

Related

Alias · CVE (1)

  • CVE-2011-4904 TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References