What is GHSA-43g8-79x3-j898?

GHSA-43g8-79x3-j898 is a security advisory published by GitHub Security Advisories with High severity. Unrestricted access to predictable file paths in hov/jobfair

Which CVE IDs does GHSA-43g8-79x3-j898 cover?

GHSA-43g8-79x3-j898 covers the following CVE IDs: CVE-2021-43564. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-43g8-79x3-j898?

GHSA-43g8-79x3-j898 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-43g8-79x3-j898?

GHSA-43g8-79x3-j898 affects 2 products, including: composer/hov/jobfair:\u003c 1.0.13; composer/hov/jobfair:\u003e= 2.0.0, \u003c 2.0.2.

GHSA-43g8-79x3-j898HighCVSS 7.5

Unrestricted access to predictable file paths in hov/jobfair

Vendor

GitHub Security Advisories

Published

November 15, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-43564 →

📋 Description

An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).

🎯 Affected products2

composer/hov/jobfair:< 1.0.13
composer/hov/jobfair:>= 2.0.0, < 2.0.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-43564
https://typo3.org/security/advisory/typo3-ext-sa-2021-018
https://github.com/advisories/GHSA-43g8-79x3-j898