GHSA-gwfx-p7mr-f92v: Missing Access Check in TYPO3 CMS
Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation.
Published Jun 5, 2024
Affected packages
typo3/cms
- Ecosystem
- Composer (PHP)
- Affected
- >= 6.2.0, < 6.2.25
- Fixed in
- 6.2.25
- Check
composer show typo3/cms
typo3/cms
- Ecosystem
- Composer (PHP)
- Affected
- >= 7.6.0, < 7.6.8
- Fixed in
- 7.6.8
- Check
composer show typo3/cms
typo3/cms
- Ecosystem
- Composer (PHP)
- Affected
- >= 8.0.0, < 8.1.1
- Fixed in
- 8.1.1
- Check
composer show typo3/cms
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.
References
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-05-24-1.yaml
- https://web.archive.org/web/20160606110438/https://typo3.org/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/missing-access-check-in-typo3-cms
- https://github.com/advisories/GHSA-gwfx-p7mr-f92v
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology