TYPO3 vulnerable to remote authenticated arbitrary code execution

보통 6.5CVE-2013-4321 · GHSA-m76j-69c2-c3m8 · Published 20/05/2014 · updated 16/06/2026

요약

CVE-2013-4321은(는) typo3/cms, typo3 (typo3)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.1%, 전체 취약점의 66.2%보다 높음.
조치: 6.0.9, 6.1.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
typo3/cms Packagist	`≥ 6.0.0, < 6.0.9≥ 6.1.0, < 6.1.4`	`6.0.96.1.4`
typo3 typo3	`= 6.0= 6.0.1= 6.0.2= 6.0.3= 6.0.4= 6.0.5= 6.0.6= 6.0.7= 6.1= 6.1.1= 6.1.2= 6.1.3`	No fix yet

Description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.

NVD description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.

References

nvd.nist.gov/vuln/detail/CVE-2013-4321 · ADVISORY
TYPO3/typo3 · PACKAGE
typo3.org/security/advisory/typo3-core-sa-2013-003 · WEB
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003 · Vendor Advisory

typo3/cms의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

typo3/cms

Packagist

≥ 6.0.0, < 6.0.9≥ 6.1.0, < 6.1.4

6.0.96.1.4

typo3

= 6.0= 6.0.1= 6.0.2= 6.0.3= 6.0.4= 6.0.5= 6.0.6= 6.0.7= 6.1= 6.1.1= 6.1.2= 6.1.3

No fix yet

Description

NVD description

typo3/cms의 다른 취약점

모두 보기 →