GHSA-r674-mc9p-hvw5
TYPO3 Improper Access Control vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | typo3/cms-core | >= 4.5.0, < 4.5.31 | 4.5.31 |
| Packagist | typo3/cms-core | >= 4.7.0, < 4.7.16 | 4.7.16 |
| Packagist | typo3/cms-core | >= 6.0.0, < 6.0.11 | 6.0.11 |
| Packagist | typo3/cms-core | >= 6.1.0, < 6.1.6 | 6.1.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.
References
External links from the advisory. They lead to third-party sites.