~ / search / GHSA-55g3-fjwm-w2c8

GHSA-55g3-fjwm-w2c8

TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

Source: GitHub Advisory Database (reviewed) High CVE-2014-3942

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms >= 4.5.0, < 4.5.34 4.5.34
Packagist typo3/cms >= 4.7.0, < 4.7.19 4.7.19
Packagist typo3/cms >= 6.0.0, < 6.0.14 6.0.14
Packagist typo3/cms >= 6.1.0, < 6.1.9 6.1.9

Details

As written in the advisory (Markdown source, shown as plain text).

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

References

External links from the advisory. They lead to third-party sites.