Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (8)
| Vulnerability |
Summary |
Aliases |
|
VCID-3yjx-zkmc-zkau
|
Improper Privilege Management
Privilege Escalation in TYPO3 CMS.
|
2016-04-12-4
|
|
VCID-8jv7-9a74-q3ee
|
Cross-site Scripting
Cross-Site Scripting in TYPO3 Backend.
|
2016-04-12-1
|
|
VCID-fehf-p36x-wfha
|
Information Exposure
Arbitrary File Disclosure in Form Component.
|
2016-04-12-2
|
|
VCID-k8yx-gezq-7fd6
|
Authentication Bypass in TYPO3 CMS
The default authentication service misses to invalidate empty strings as password. Therefore it is possible to authenticate backend and frontend users without password set in the database.
Note: TYPO3 does not allow to create user accounts without a password. Your TYPO3 installation might only be affected if there is a third party component creating user accounts without password by directly manipulating the database.
|
GHSA-6xh8-8pfv-53vx
|
|
VCID-vujd-b56y-8kfk
|
Privilege Escalation in TYPO3 CMS
The workspace/ version preview link created by a privileged (backend) user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability.
|
GHSA-v5jp-4h2p-j2p4
|
|
VCID-x5wu-b995-xkcm
|
Improper Authentication
Authentication Bypass in TYPO3 CMS.
|
2016-04-12-3
|
|
VCID-z5h8-5shq-kbgh
|
Typo3 Arbitrary File Disclosure in Form Component
Failing to properly validate user input, the form component is susceptible to Arbitrary File Disclosure. A valid backend user account is needed to exploit this vulnerability. Only forms are vulnerable, which contain upload fields.
|
GHSA-wrpf-2x8h-82gr
|
|
VCID-zu53-dnd1-h3gu
|
Cross-Site Scripting in TYPO3 Backend
Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
|
GHSA-5wx6-xwxf-q8qj
|