CVE-2017-14251

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-14251
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14251.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-14251
Aliases
Published
2017-09-11T09:29:00.467Z
Modified
2026-07-08T05:50:18.842372797Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "7.6.0"
                },
                {
                    "last_affected": "7.6.0"
                },
                {
                    "introduced": "7.6.0"
                },
                {
                    "last_affected": "7.6.0"
                }
            ],
            "vendor_product": "typo3:typo3"
        }
    ]
}
References

Affected packages

Git / github.com/benjaminkott/bootstrap_package

Affected ranges

Type
GIT
Repo
https://github.com/benjaminkott/bootstrap_package
Events
Introduced
2948aa3f9c34483477af9d18f89423eae07ede34
Last affected
86bdd2dec46ddc0c25c65b4695160ae14b3b4679
Database specific 
{
    "cpe": [
        "cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.0.0"
        },
        {
            "introduced": "8.0.1"
        },
        {
            "last_affected": "8.0.1"
        }
    ]
}

Affected versions

8.*
8.0.0
8.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14251.json"

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
a2585ba26b9df87ef67fdbb4f53d2f1a891d919f
Last affected
c7c31332ac2222d03f29be627de34bb58bde0954
Database specific 
{
    "cpe": [
        "cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.21:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.1.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.2.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.3.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.5.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.5.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.4:*:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "7.6.0"
        },
        {
            "last_affected": "7.6.0"
        },
        {
            "introduced": "7.6.1"
        },
        {
            "last_affected": "7.6.1"
        },
        {
            "introduced": "7.6.2"
        },
        {
            "last_affected": "7.6.2"
        },
        {
            "introduced": "7.6.3"
        },
        {
            "last_affected": "7.6.3"
        },
        {
            "introduced": "7.6.4"
        },
        {
            "last_affected": "7.6.4"
        },
        {
            "introduced": "7.6.5"
        },
        {
            "last_affected": "7.6.5"
        },
        {
            "introduced": "7.6.6"
        },
        {
            "last_affected": "7.6.6"
        },
        {
            "introduced": "7.6.7"
        },
        {
            "last_affected": "7.6.7"
        },
        {
            "introduced": "7.6.8"
        },
        {
            "last_affected": "7.6.8"
        },
        {
            "introduced": "7.6.9"
        },
        {
            "last_affected": "7.6.9"
        },
        {
            "introduced": "7.6.10"
        },
        {
            "last_affected": "7.6.10"
        },
        {
            "introduced": "7.6.11"
        },
        {
            "last_affected": "7.6.11"
        },
        {
            "introduced": "7.6.12"
        },
        {
            "last_affected": "7.6.12"
        },
        {
            "introduced": "7.6.13"
        },
        {
            "last_affected": "7.6.13"
        },
        {
            "introduced": "7.6.14"
        },
        {
            "last_affected": "7.6.14"
        },
        {
            "introduced": "7.6.15"
        },
        {
            "last_affected": "7.6.15"
        },
        {
            "introduced": "7.6.16"
        },
        {
            "last_affected": "7.6.16"
        },
        {
            "introduced": "7.6.17"
        },
        {
            "last_affected": "7.6.17"
        },
        {
            "introduced": "7.6.18"
        },
        {
            "last_affected": "7.6.18"
        },
        {
            "introduced": "7.6.19"
        },
        {
            "last_affected": "7.6.19"
        },
        {
            "introduced": "7.6.20"
        },
        {
            "last_affected": "7.6.20"
        },
        {
            "introduced": "7.6.21"
        },
        {
            "last_affected": "7.6.21"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.0.0"
        },
        {
            "introduced": "8.0.1"
        },
        {
            "last_affected": "8.0.1"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "last_affected": "8.1.0"
        },
        {
            "introduced": "8.1.1"
        },
        {
            "last_affected": "8.1.1"
        },
        {
            "introduced": "8.1.2"
        },
        {
            "last_affected": "8.1.2"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "last_affected": "8.2.0"
        },
        {
            "introduced": "8.2.1"
        },
        {
            "last_affected": "8.2.1"
        },
        {
            "introduced": "8.3.0"
        },
        {
            "last_affected": "8.3.0"
        },
        {
            "introduced": "8.3.1"
        },
        {
            "last_affected": "8.3.1"
        },
        {
            "introduced": "8.4.0"
        },
        {
            "last_affected": "8.4.0"
        },
        {
            "introduced": "8.4.1"
        },
        {
            "last_affected": "8.4.1"
        },
        {
            "introduced": "8.5.0"
        },
        {
            "last_affected": "8.5.0"
        },
        {
            "introduced": "8.5.1"
        },
        {
            "last_affected": "8.5.1"
        },
        {
            "introduced": "8.6.0"
        },
        {
            "last_affected": "8.6.0"
        },
        {
            "introduced": "8.6.1"
        },
        {
            "last_affected": "8.6.1"
        },
        {
            "introduced": "8.7.0"
        },
        {
            "last_affected": "8.7.0"
        },
        {
            "introduced": "8.7.1"
        },
        {
            "last_affected": "8.7.1"
        },
        {
            "introduced": "8.7.2"
        },
        {
            "last_affected": "8.7.2"
        },
        {
            "introduced": "8.7.3"
        },
        {
            "last_affected": "8.7.3"
        },
        {
            "introduced": "8.7.4"
        },
        {
            "last_affected": "8.7.4"
        }
    ]
}

Affected versions

7.*
7.6.0
7.6.1
7.6.10
7.6.11
7.6.12
7.6.13
7.6.14
7.6.15
7.6.16
7.6.17
7.6.18
7.6.19
7.6.2
7.6.20
7.6.21
7.6.3
7.6.4
7.6.5
7.6.6
7.6.7
7.6.8
7.6.9
8.*
8.0.0
8.0.1
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.3.0
8.3.1
8.4.0
8.4.1
8.5.0
8.5.1
8.6.0
8.6.1
8.7.0
8.7.1
8.7.2
8.7.3
8.7.4
Other
TYPO3_7-6-0
TYPO3_7-6-1
TYPO3_7-6-2
TYPO3_8-0-0
TYPO3_8-1-0
TYPO3_8-2-0
TYPO3_8-3-0
TYPO3_8-4-0
TYPO3_8-5-0
TYPO3_8-6-0
TYPO3_8-7-0
TYPO3_8-7-1
TYPO3_8-7-2
TYPO3_8-7-4
v8.*
v8.7.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14251.json"