Typo3 Extbase Framework Unsafe Deserialization

MEDIUM 5.0CVE-2012-1605 · GHSA-7jfm-px59-99w8 · Published 04/09/2012 · updated 16/06/2026

In short

CVE-2012-1605 is a MEDIUM (CVSS 5.0) vulnerability affecting typo3/cms, typo3 (typo3).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 83.8% of all vulnerabilities.
Fix: update to 4.4.14, 4.5.14, 4.6.7 or later.

Package	Affected versions	Patched versions
typo3/cms Packagist	`≥ 4.4.0, < 4.4.14≥ 4.5.0, < 4.5.14≥ 4.6, < 4.6.7`	`4.4.144.5.144.6.7`
typo3 typo3	`= 4.6= 4.6.0= 4.6.1= 4.6.2= 4.6.3= 4.6.4= 4.6.5= 4.6.6= 4.7= 6.0`	No fix yet

Description

The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."

NVD description

References

More vulnerabilities in typo3/cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

typo3/cms

Packagist

≥ 4.4.0, < 4.4.14≥ 4.5.0, < 4.5.14≥ 4.6, < 4.6.7

4.4.144.5.144.6.7

typo3

= 4.6= 4.6.0= 4.6.1= 4.6.2= 4.6.3= 4.6.4= 4.6.5= 4.6.6= 4.7= 6.0

No fix yet

Description

NVD description

More vulnerabilities in typo3/cms

See all →