What is GHSA-598p-rv6p-g7qc?

GHSA-598p-rv6p-g7qc is a security advisory published by GitHub Security Advisories with Critical severity. sr_freecap for Typo3 RCE Vulnerability

Which CVE IDs does GHSA-598p-rv6p-g7qc cover?

GHSA-598p-rv6p-g7qc covers the following CVE IDs: CVE-2019-16699. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-598p-rv6p-g7qc?

GHSA-598p-rv6p-g7qc has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-598p-rv6p-g7qc?

GHSA-598p-rv6p-g7qc affects 2 products, including: composer/sjbr/sr-freecap:\u003e= 2.5.0, \u003c 2.5.3; composer/sjbr/sr-freecap:\u003c 2.4.6.

GHSA-598p-rv6p-g7qcCriticalCVSS 9.8

sr_freecap for Typo3 RCE Vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 26, 2023

🔗 CVE IDs covered (1)

CVE-2019-16699 →

📋 Description

The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.

🎯 Affected products2

composer/sjbr/sr-freecap:>= 2.5.0, < 2.5.3
composer/sjbr/sr-freecap:< 2.4.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-16699
https://extensions.typo3.org/extension/sr_freecap
https://typo3.org/security/advisory/typo3-ext-sa-2019-018/
https://github.com/advisories/GHSA-598p-rv6p-g7qc