GHSA-m76j-69c2-c3m8

TYPO3 vulnerable to remote authenticated arbitrary code execution

Source: GitHub Advisory Database (reviewed) High CVE-2013-4321

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	typo3/cms	>= 6.0.0, < 6.0.9	6.0.9
Packagist	typo3/cms	>= 6.1.0, < 6.1.4	6.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-4321 advisory
https://github.com/TYPO3/typo3 package
https://typo3.org/security/advisory/typo3-core-sa-2013-003 web