| Package | Affected versions | Patched versions |
|---|---|---|
| typo3/cms-core | ≥ 10.0.0, < 10.4.43≥ 11.0.0, < 11.5.35≥ 12.0.0, < 12.4.11≥ 13.0.0, < 13.0.1≥ 8.0.0, < 8.7.57≥ 9.0.0, < 9.5.46 | 10.4.4311.5.3512.4.1113.0.18.7.579.5.46 |
| typo3 | = 13.0.0≥ 10.0.0, < 10.4.43≥ 11.0.0, < 11.5.35≥ 12.0.0, < 12.4.11≥ 8.0.0, < 8.7.57≥ 9.0.0, < 9.5.46 | 10.4.4311.5.3512.4.118.7.579.5.46 |
Several settings in the Install Tool for configuring the path to system binaries were vulnerable to code execution. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.
The corresponding change for this advisory involves enforcing the known disadvantages described in TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode.
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
Thanks to Rickmer Frier & Daniel Jonka who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free