GHSA-47ww-mq32-g4xw

Source

https://github.com/advisories/GHSA-47ww-mq32-g4xw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-47ww-mq32-g4xw/GHSA-47ww-mq32-g4xw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-47ww-mq32-g4xw

Aliases

CVE-2013-7075

Published

2022-05-17T04:54:41Z

Modified

2023-11-08T03:57:27.585389Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component

Details

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."

Database specific

{
    "nvd_published_at": "2013-12-23T23:55:00Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T19:02:19Z"
}

References

Affected packages

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.5.0

Fixed

4.5.32

Database specific

{
    "last_known_affected_version_range": "<= 4.5.31"
}

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.7.0

Fixed

4.7.17

Database specific

{
    "last_known_affected_version_range": "<= 4.7.16"
}

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.0.12

Database specific

{
    "last_known_affected_version_range": "<= 6.0.11"
}

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.1.0

Fixed

6.1.7

Database specific

{
    "last_known_affected_version_range": "<= 6.1.6"
}