Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2010-3663

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

VectorNETWORK

PublishedNov 04, 2019, 22:15

Published Bycve@mitre.org

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

typo3/cms-backend(Packagist)04.1.14N/A

typo3/cms-backend(Packagist)4.24.2.13N/A

typo3/cms-backend(Packagist)4.34.3.4N/A

typo3/cms-backend(Packagist)4.44.4.1N/A

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719
https://security-tracker.debian.org/tracker/CVE-2010-3663
https://typo3.org/security/advisory/typo3-sa-2010-012/#Arbitrary_Code_Execution

Weakness Type

CWE-434

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK