Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-74w6-ww7w-45j9
Advisory ID github_osv/GHSA-74w6-ww7w-45j9
Aliases CVE-2009-0258
Summary Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
System Score Found at
generic_textual HIGH
Reference id Reference type URL
https://exchange.xforce.ibmcloud.com/vulnerabilities/48138
https://web.archive.org/web/20111210005350/http://www.securityfocus.com/bid/33376
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001
http://www.debian.org/security/2009/dsa-1711
http://www.openwall.com/lists/oss-security/2009/01/23/4
CVE-2009-0258 https://nvd.nist.gov/vuln/detail/CVE-2009-0258
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.