GitHub Advisoryadvisory · Packagist

GHSA-r674-mc9p-hvw5 TYPO3 Improper Access Control vulnerability

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2013-7081
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2023-08-29

Affected packages

• Packagist typo3/cms-core: >= 4.5.0, < 4.5.31 → fixed in 4.5.31 • Packagist typo3/cms-core: >= 4.7.0, < 4.7.16 → fixed in 4.7.16 • Packagist typo3/cms-core: >= 6.0.0, < 6.0.11 → fixed in 6.0.11 • Packagist typo3/cms-core: >= 6.1.0, < 6.1.6 → fixed in 6.1.6

Description

The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2013-7081 The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References