Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (9)
| Vulnerability |
Summary |
Aliases |
|
VCID-1d1x-7vx6-zbfw
|
TYPO3 Arbitrary Code Execution
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.
|
CVE-2017-14251
GHSA-fh4q-hxrw-cjqq
|
|
VCID-2x7t-5tdv-cuge
|
XSS Vulnerability
Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
|
TYPO3-CORE-SA-2017-004
|
|
VCID-brcm-16va-3yek
|
Information Disclosure in TYPO3 CMS
HTTP requests being performed using the TYPO3 API expose the specific TYPO3 version to the called endpoint.
|
GHSA-c7p6-3c9c-f88q
|
|
VCID-fru4-hjhx-47ev
|
Information Disclosure
HTTP requests being performed using the TYPO3 API expose the specific TYPO3 version to the called endpoint.
|
TYPO3-CORE-SA-2017-006
|
|
VCID-u6ar-3wzb-u3eg
|
Information Disclosure in TYPO3 CMS
Failing to properly check user permission on file storages, editors could gain knowledge of protected storages and its folders as well as using them in a file collection being rendered in the frontend. A valid backend user account is needed to exploit this vulnerability.
|
GHSA-g46h-v2cc-6c94
|
|
VCID-vyhd-x5fe-b3aj
|
Information Disclosure
Failing to properly check user permission on file storages, editors could gain knowledge of protected storages and its folders as well as using them in a file collection being rendered in the frontend. A valid backend user account is needed to exploit this vulnerability.
|
TYPO3-CORE-SA-2017-005
|
|
VCID-x3t4-7hux-zya8
|
Cross-Site Scripting in TYPO3 CMS Backend
Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
|
GHSA-v4qr-8h2v-qpjx
|
|
VCID-xg9s-8fv2-87hq
|
Arbitrary Code Execution in TYPO3 CMS
Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload *.pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool.
```
\.(php[3-7]?|phpsh|phtml|pht)(\..*)?$|^\.htaccess$
```
|
GHSA-67wg-6j7r-mqh8
|
|
VCID-yz56-gs5x-hudr
|
Arbitrary Code Execution
Due to a missing file extension in the `fileDenyPattern`, backend user are allowed to upload *.pht files which can be executed in certain web server setups.
|
TYPO3-CORE-SA-2017-007
|