Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2019-16699

The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.

VectorNETWORK

PublishedOct 16, 2019, 19:15

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

sjbr/sr-freecap(Packagist)2.5.02.5.3N/A

sjbr/sr-freecap(Packagist)02.4.6N/A

References

https://extensions.typo3.org/extension/sr_freecap
https://typo3.org/security/advisory/typo3-ext-sa-2019-018/

Weakness Type

CWE-20

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK