GHSA-4r76-xr68-w7m7

Source

https://github.com/advisories/GHSA-4r76-xr68-w7m7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-4r76-xr68-w7m7/GHSA-4r76-xr68-w7m7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4r76-xr68-w7m7

Published

2024-05-30T21:02:59Z

Modified

2024-12-05T05:43:03Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts

Details

It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.

Database specific

{
    "cwe_ids":  [
        "CWE-269"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-05-30T21:02:59Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.2.14

Affected versions

6.*

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

6.2.7

6.2.8

6.2.9

6.2.10-rc1

6.2.10

6.2.11

6.2.12

6.2.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-4r76-xr68-w7m7/GHSA-4r76-xr68-w7m7.json"

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.3.1

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.1.0

7.2.0

7.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-4r76-xr68-w7m7/GHSA-4r76-xr68-w7m7.json"