What is GHSA-p9jg-9w87-6rg4?

GHSA-p9jg-9w87-6rg4 is a security advisory published by GitHub Security Advisories with Medium severity. TYPO3 Improper Access Management in the File Abstraction Layer

Which CVE IDs does GHSA-p9jg-9w87-6rg4 cover?

GHSA-p9jg-9w87-6rg4 covers the following CVE IDs: CVE-2013-4320. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-p9jg-9w87-6rg4?

GHSA-p9jg-9w87-6rg4 affects 2 products, including: composer/typo3/cms-core:\u003e= 6.0, \u003c 6.0.9; composer/typo3/cms-core:\u003e= 6.1, \u003c 6.1.4.

GHSA-p9jg-9w87-6rg4Medium

TYPO3 Improper Access Management in the File Abstraction Layer

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 28, 2023

🔗 CVE IDs covered (1)

CVE-2013-4320 →

📋 Description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

🎯 Affected products2

composer/typo3/cms-core:>= 6.0, < 6.0.9
composer/typo3/cms-core:>= 6.1, < 6.1.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2013-4320
https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/
https://github.com/advisories/GHSA-p9jg-9w87-6rg4