GHSA-wjpc-gjf7-9938HighCVSS 8.8

TYPO3 Arbitrary Code Execution vulnerability on the backend

Published
April 21, 2022
Last Modified
February 6, 2024

🔗 CVE IDs covered (1)

CVE-2010-3663 →

📋 Description

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

🎯 Affected products4

  • composer/typo3/cms-backend:< 4.1.14
  • composer/typo3/cms-backend:>= 4.2, < 4.2.13
  • composer/typo3/cms-backend:>= 4.3, < 4.3.4
  • composer/typo3/cms-backend:>= 4.4, < 4.4.1

🔗 References (5)