CVE-2012-1605 - The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which

CVE-2012-1605

Summary

The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."

References

Vulnerable Configurations

cpe:2.3:a:typo3:typo3:4.6:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.0:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.0:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.1:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.1:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.3:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.3:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.4:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.4:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.5:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.5:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.6:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.6.6:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.7:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:4.7:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:6.0:*:*:*:*:*:*:*
cpe:2.3:a:typo3:typo3:6.0:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 05-09-2012 - 13:46)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:P/A:N

refmap via4

bid	52771
confirm	http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/
mlist	[oss-security] 20120329 Re: CVE request: TYPO3-CORE-SA-2012-001
osvdb	80759

Last major update

05-09-2012 - 13:46

Published

04-09-2012 - 20:55

Last modified

05-09-2012 - 13:46