GHSA-5w2h-59j3-8x5w

Source

https://github.com/advisories/GHSA-5w2h-59j3-8x5w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-5w2h-59j3-8x5w/GHSA-5w2h-59j3-8x5w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5w2h-59j3-8x5w

Aliases

CVE-2024-22188

Published

2024-02-13T20:32:27Z

Modified

2024-08-28T19:45:48.814052Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

TYPO3 Install Tool vulnerable to Code Execution

Details

Problem

Several settings in the Install Tool for configuring the path to system binaries were vulnerable to code execution. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.

The corresponding change for this advisory involves enforcing the known disadvantages described in TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode.

Solution

Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.

Credits

Thanks to Rickmer Frier & Daniel Jonka who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue.

References

TYPO3-CORE-SA-2024-002

Database specific

{
    "nvd_published_at": "2024-03-05T02:15:27Z",
    "cwe_ids": [
        "CWE-77",
        "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-13T20:32:27Z"
}

References

Affected packages

Packagist / typo3/cms-core

Package

Name: typo3/cms-core
Purl: pkg:composer/typo3/cms-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0.0

Fixed

8.7.57

Affected versions

v8.*

v8.7.7

v8.7.8

v8.7.9

v8.7.10

v8.7.11

v8.7.12

v8.7.13

v8.7.14

v8.7.15

v8.7.16

v8.7.17

v8.7.18

v8.7.19

v8.7.20

v8.7.21

v8.7.22

v8.7.23

v8.7.24

v8.7.25

v8.7.26

v8.7.27

v8.7.28

v8.7.29

v8.7.30

v8.7.31

v8.7.32

Database specific

{
    "last_known_affected_version_range": "<= 8.7.56"
}

Packagist / typo3/cms-core

Package

Name: typo3/cms-core
Purl: pkg:composer/typo3/cms-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0

Fixed

9.5.46

Affected versions

v9.*

v9.0.0

v9.1.0

v9.2.0

v9.2.1

v9.3.0

v9.3.1

v9.3.2

v9.3.3

v9.4.0

v9.5.0

v9.5.1

v9.5.2

v9.5.3

v9.5.4

v9.5.5

v9.5.6

v9.5.7

v9.5.8

v9.5.9

v9.5.10

v9.5.11

v9.5.12

v9.5.13

v9.5.14

v9.5.15

v9.5.16

v9.5.17

v9.5.18

v9.5.19

v9.5.20

v9.5.21

v9.5.22

v9.5.23

v9.5.24

v9.5.25

v9.5.26

v9.5.27

v9.5.28

v9.5.29

v9.5.30

v9.5.31

Database specific

{
    "last_known_affected_version_range": "<= 9.5.45"
}

Packagist / typo3/cms-core

Package

Name: typo3/cms-core
Purl: pkg:composer/typo3/cms-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10.0.0

Fixed

10.4.43

Affected versions

v10.*

v10.0.0

v10.1.0

v10.2.0

v10.2.1

v10.2.2

v10.3.0

v10.4.0

v10.4.1

v10.4.2

v10.4.3

v10.4.4

v10.4.5

v10.4.6

v10.4.7

v10.4.8

v10.4.9

v10.4.10

v10.4.11

v10.4.12

v10.4.13

v10.4.14

v10.4.15

v10.4.16

v10.4.17

v10.4.18

v10.4.19

v10.4.20

v10.4.21

v10.4.22

v10.4.23

v10.4.24

v10.4.25

v10.4.26

v10.4.27

v10.4.28

v10.4.29

v10.4.30

v10.4.31

v10.4.32

v10.4.33

v10.4.34

v10.4.36

v10.4.37

Database specific

{
    "last_known_affected_version_range": "<= 10.4.42"
}

Packagist / typo3/cms-core

Package

Name: typo3/cms-core
Purl: pkg:composer/typo3/cms-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11.0.0

Fixed

11.5.35

Affected versions

v11.*

v11.0.0

v11.1.0

v11.1.1

v11.2.0

v11.3.0

v11.3.1

v11.3.2

v11.3.3

v11.4.0

v11.5.0

v11.5.1

v11.5.2

v11.5.3

v11.5.4

v11.5.5

v11.5.6

v11.5.7

v11.5.8

v11.5.9

v11.5.10

v11.5.11

v11.5.12

v11.5.13

v11.5.14

v11.5.15

v11.5.16

v11.5.17

v11.5.18

v11.5.19

v11.5.20

v11.5.21

v11.5.22

v11.5.23

v11.5.24

v11.5.25

v11.5.26

v11.5.27

v11.5.28

v11.5.29

v11.5.30

v11.5.31

v11.5.32

v11.5.33

v11.5.34

Database specific

{
    "last_known_affected_version_range": "<= 11.5.34"
}

Packagist / typo3/cms-core

Package

Name: typo3/cms-core
Purl: pkg:composer/typo3/cms-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12.0.0

Fixed

12.4.11

Affected versions

v12.*

v12.0.0

v12.1.0

v12.1.1

v12.1.2

v12.1.3

v12.2.0

v12.3.0

v12.4.0

v12.4.1

v12.4.2

v12.4.3

v12.4.4

v12.4.5

v12.4.6

v12.4.7

v12.4.8

v12.4.9

v12.4.10

Database specific

{
    "last_known_affected_version_range": "<= 12.4.10"
}

GHSA-5w2h-59j3-8x5w

Problem

Solution

Credits

References

Affected packages

Packagist / typo3/cms-core

Package

Affected ranges

Affected versions

v8.*

Database specific

Packagist / typo3/cms-core

Package

Affected ranges

Affected versions

v9.*

Database specific

Packagist / typo3/cms-core

Package

Affected ranges

Affected versions

v10.*

Database specific

Packagist / typo3/cms-core

Package

Affected ranges

Affected versions

v11.*

Database specific

Packagist / typo3/cms-core

Package

Affected ranges

Affected versions

v12.*

Database specific

Packagist / typo3/cms-core

Package

Affected ranges

Affected versions

13.*

v13.*