GHSA-m4hw-r893-xh4gMedium

TYPO3 allows remote authenticated backend users to unserialize arbitrary objects

Published
May 17, 2022
Last Modified
April 12, 2025

🔗 CVE IDs covered (1)

CVE-2012-3527 →

📋 Description

view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."

🎯 Affected products3

  • composer/typo3/cms:>= 4.5.0, < 4.5.19
  • composer/typo3/cms:>= 4.6.0, < 4.6.12
  • composer/typo3/cms:>= 4.7.0, < 4.7.4

🔗 References (6)