Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (6)
| Vulnerability |
Summary |
Aliases |
|
VCID-3yjx-zkmc-zkau
|
Improper Privilege Management
Privilege Escalation in TYPO3 CMS.
|
2016-04-12-4
|
|
VCID-8jv7-9a74-q3ee
|
Cross-site Scripting
Cross-Site Scripting in TYPO3 Backend.
|
2016-04-12-1
|
|
VCID-k8yx-gezq-7fd6
|
Authentication Bypass in TYPO3 CMS
The default authentication service misses to invalidate empty strings as password. Therefore it is possible to authenticate backend and frontend users without password set in the database.
Note: TYPO3 does not allow to create user accounts without a password. Your TYPO3 installation might only be affected if there is a third party component creating user accounts without password by directly manipulating the database.
|
GHSA-6xh8-8pfv-53vx
|
|
VCID-vujd-b56y-8kfk
|
Privilege Escalation in TYPO3 CMS
The workspace/ version preview link created by a privileged (backend) user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability.
|
GHSA-v5jp-4h2p-j2p4
|
|
VCID-x5wu-b995-xkcm
|
Improper Authentication
Authentication Bypass in TYPO3 CMS.
|
2016-04-12-3
|
|
VCID-zu53-dnd1-h3gu
|
Cross-Site Scripting in TYPO3 Backend
Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
|
GHSA-5wx6-xwxf-q8qj
|