GHSA-5fj8-wh3g-qvq2Medium

TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

Published
May 17, 2022
Last Modified
August 29, 2023

🔗 CVE IDs covered (1)

CVE-2013-7080 →

📋 Description

The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted links, aka "Mass Assignment."

🎯 Affected products3

  • composer/typo3/cms-core:>= 4.5.0, < 4.5.31
  • composer/typo3/cms-core:>= 4.6.0, < 4.7.16
  • composer/typo3/cms-core:>= 6.0.0, < 6.0.11

🔗 References (5)