Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-30451 (GCVE-0-2023-30451)
Vulnerability from cvelistv5
- n/a
URL | Tags | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:21:44.837Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF]." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2023-12-25T05:02:47.293044", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2023-30451", "datePublished": "2023-12-25T00:00:00", "dateReserved": "2023-04-08T00:00:00", "dateUpdated": "2024-08-02T14:21:44.837Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-30451\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2023-12-25T05:15:08.553\",\"lastModified\":\"2024-11-21T08:00:12.673\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].\"},{\"lang\":\"es\",\"value\":\"En TYPO3 11.5.24, el componente filelist permite a los atacantes (que tienen acceso al panel de administrador) leer archivos arbitrarios a trav\u00e9s del directory traversal en el campo baseuri, como lo demuestra POST /typo3/record/edit con ../../. ./ en datos[sys_file_storage]*[datos][sDEF][lDEF][basePath][vDEF].\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typo3:typo3:11.5.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39861941-0E9B-46A9-9C88-4886FEE7C544\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}" } }
WID-SEC-W-2024-0357
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- MacOS X\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0357 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0357.json" }, { "category": "self", "summary": "WID-SEC-2024-0357 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0357" }, { "category": "external", "summary": "TYPO3 13.0.1, 12.4.11 and 11.5.35 Security Release vom 2024-02-12", "url": "https://typo3.org/article/typo3-1301-12411-and-11535-security-releases-published" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-001" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-002" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-003" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-004" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-005" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-006" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-001" } ], "source_lang": "en-US", "title": "TYPO3 Core und TYPO3 Extension: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-02-12T23:00:00.000+00:00", "generator": { "date": "2024-08-15T18:05:08.407+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2024-0357", "initial_release_date": "2024-02-12T23:00:00.000+00:00", "revision_history": [ { "date": "2024-02-12T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c 13.0.1", "product": { "name": "TYPO3 Core \u003c 13.0.1", "product_id": "T032712" } }, { "category": "product_version_range", "name": "\u003c 12.4.11", "product": { "name": "TYPO3 Core \u003c 12.4.11", "product_id": "T032713" } }, { "category": "product_version_range", "name": "\u003c 11.5.35", "product": { "name": "TYPO3 Core \u003c 11.5.35", "product_id": "T032714" } }, { "category": "product_version_range", "name": "\u003c 8.7.57", "product": { "name": "TYPO3 Core \u003c 8.7.57", "product_id": "T032716" } }, { "category": "product_version_range", "name": "\u003c 9.5.46", "product": { "name": "TYPO3 Core \u003c 9.5.46", "product_id": "T032717" } }, { "category": "product_version_range", "name": "\u003c 10.4.43", "product": { "name": "TYPO3 Core \u003c 10.4.43", "product_id": "T032718" } } ], "category": "product_name", "name": "Core" }, { "branches": [ { "category": "product_version_range", "name": "\u003c 7.4.0", "product": { "name": "TYPO3 Extension \u003c 7.4.0", "product_id": "T032715" } } ], "category": "product_name", "name": "Extension" } ], "category": "vendor", "name": "TYPO3" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-25121", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25121" }, { "cve": "CVE-2024-25120", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25120" }, { "cve": "CVE-2024-25119", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25119" }, { "cve": "CVE-2024-25118", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25118" }, { "cve": "CVE-2024-24751", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-24751" }, { "cve": "CVE-2024-22188", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-22188" }, { "cve": "CVE-2023-30451", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2023-30451" } ] }
wid-sec-w-2024-0357
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- MacOS X\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0357 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0357.json" }, { "category": "self", "summary": "WID-SEC-2024-0357 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0357" }, { "category": "external", "summary": "TYPO3 13.0.1, 12.4.11 and 11.5.35 Security Release vom 2024-02-12", "url": "https://typo3.org/article/typo3-1301-12411-and-11535-security-releases-published" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-001" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-002" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-003" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-004" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-005" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-006" }, { "category": "external", "summary": "Typo3 Security Advisory vom 2024-02-12", "url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-001" } ], "source_lang": "en-US", "title": "TYPO3 Core und TYPO3 Extension: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-02-12T23:00:00.000+00:00", "generator": { "date": "2024-08-15T18:05:08.407+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2024-0357", "initial_release_date": "2024-02-12T23:00:00.000+00:00", "revision_history": [ { "date": "2024-02-12T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c 13.0.1", "product": { "name": "TYPO3 Core \u003c 13.0.1", "product_id": "T032712" } }, { "category": "product_version_range", "name": "\u003c 12.4.11", "product": { "name": "TYPO3 Core \u003c 12.4.11", "product_id": "T032713" } }, { "category": "product_version_range", "name": "\u003c 11.5.35", "product": { "name": "TYPO3 Core \u003c 11.5.35", "product_id": "T032714" } }, { "category": "product_version_range", "name": "\u003c 8.7.57", "product": { "name": "TYPO3 Core \u003c 8.7.57", "product_id": "T032716" } }, { "category": "product_version_range", "name": "\u003c 9.5.46", "product": { "name": "TYPO3 Core \u003c 9.5.46", "product_id": "T032717" } }, { "category": "product_version_range", "name": "\u003c 10.4.43", "product": { "name": "TYPO3 Core \u003c 10.4.43", "product_id": "T032718" } } ], "category": "product_name", "name": "Core" }, { "branches": [ { "category": "product_version_range", "name": "\u003c 7.4.0", "product": { "name": "TYPO3 Extension \u003c 7.4.0", "product_id": "T032715" } } ], "category": "product_name", "name": "Extension" } ], "category": "vendor", "name": "TYPO3" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-25121", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25121" }, { "cve": "CVE-2024-25120", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25120" }, { "cve": "CVE-2024-25119", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25119" }, { "cve": "CVE-2024-25118", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-25118" }, { "cve": "CVE-2024-24751", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-24751" }, { "cve": "CVE-2024-22188", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2024-22188" }, { "cve": "CVE-2023-30451", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension. Diese Fehler bestehen in mehreren Unterkomponenten wie dem File Abstraction Layer, dem Install Tool oder der Form Engine, unter anderem aufgrund verschiedener sicherheitsrelevanter Probleme wie einem Path Traversal, einer unzureichenden Verteidigung gegen Brute-Force-Techniken oder einer fehlerhaften Zugriffspr\u00fcfung. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen." } ], "release_date": "2024-02-12T23:00:00.000+00:00", "title": "CVE-2023-30451" } ] }
WID-SEC-W-2023-3212
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in TYPO3 Core ausnutzen, um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3212 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3212.json" }, { "category": "self", "summary": "WID-SEC-2023-3212 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3212" }, { "category": "external", "summary": "GitHub Advisory Database - Typo3 vom 2023-12-26", "url": "https://github.com/advisories/GHSA-3gjc-mp82-fj4q" }, { "category": "external", "summary": "Funktionaler Exploit", "url": "https://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ], "source_lang": "en-US", "title": "TYPO3 Core: Schwachstelle erm\u00f6glicht Offenlegung von Informationen", "tracking": { "current_release_date": "2023-12-26T23:00:00.000+00:00", "generator": { "date": "2024-08-15T18:03:08.734+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-3212", "initial_release_date": "2023-12-26T23:00:00.000+00:00", "revision_history": [ { "date": "2023-12-26T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "TYPO3 Core 11.5.24", "product": { "name": "TYPO3 Core 11.5.24", "product_id": "T031820", "product_identification_helper": { "cpe": "cpe:/a:typo3:typo3:11.5.24" } } } ], "category": "vendor", "name": "TYPO3" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-30451", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in TYPO3 Core. Dieser Fehler besteht aufgrund eines Path-Traversal-Problems, das es einem Benutzer mit Zugriff auf das Administrator-Panel erm\u00f6glicht, beliebige Dateien zu lesen. Ein entfernter, authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T031820" ] }, "release_date": "2023-12-26T23:00:00.000+00:00", "title": "CVE-2023-30451" } ] }
wid-sec-w-2023-3212
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in TYPO3 Core ausnutzen, um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3212 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3212.json" }, { "category": "self", "summary": "WID-SEC-2023-3212 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3212" }, { "category": "external", "summary": "GitHub Advisory Database - Typo3 vom 2023-12-26", "url": "https://github.com/advisories/GHSA-3gjc-mp82-fj4q" }, { "category": "external", "summary": "Funktionaler Exploit", "url": "https://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ], "source_lang": "en-US", "title": "TYPO3 Core: Schwachstelle erm\u00f6glicht Offenlegung von Informationen", "tracking": { "current_release_date": "2023-12-26T23:00:00.000+00:00", "generator": { "date": "2024-08-15T18:03:08.734+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-3212", "initial_release_date": "2023-12-26T23:00:00.000+00:00", "revision_history": [ { "date": "2023-12-26T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "TYPO3 Core 11.5.24", "product": { "name": "TYPO3 Core 11.5.24", "product_id": "T031820", "product_identification_helper": { "cpe": "cpe:/a:typo3:typo3:11.5.24" } } } ], "category": "vendor", "name": "TYPO3" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-30451", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in TYPO3 Core. Dieser Fehler besteht aufgrund eines Path-Traversal-Problems, das es einem Benutzer mit Zugriff auf das Administrator-Panel erm\u00f6glicht, beliebige Dateien zu lesen. Ein entfernter, authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T031820" ] }, "release_date": "2023-12-26T23:00:00.000+00:00", "title": "CVE-2023-30451" } ] }
gsd-2023-30451
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2023-30451", "id": "GSD-2023-30451" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2023-30451" ], "details": "In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].", "id": "GSD-2023-30451", "modified": "2023-12-13T01:20:51.869826Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2023-30451", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF]." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ] } }, "nvd.nist.gov": { "cve": { "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:typo3:typo3:11.5.24:*:*:*:*:*:*:*", "matchCriteriaId": "39861941-0E9B-46A9-9C88-4886FEE7C544", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "descriptions": [ { "lang": "en", "value": "In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF]." }, { "lang": "es", "value": "En TYPO3 11.5.24, el componente filelist permite a los atacantes (que tienen acceso al panel de administrador) leer archivos arbitrarios a trav\u00e9s del directory traversal en el campo baseuri, como lo demuestra POST /typo3/record/edit con ../../. ./ en datos[sys_file_storage]*[datos][sDEF][lDEF][basePath][vDEF]." } ], "id": "CVE-2023-30451", "lastModified": "2024-01-03T21:02:47.050", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2023-12-25T05:15:08.553", "references": [ { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-22" } ], "source": "nvd@nist.gov", "type": "Primary" } ] } } } }
CERTFR-2024-AVI-0121
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Typo3. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneVendor | Product | Description | ||
---|---|---|---|---|
Typo3 | Typo3 | Typo3 versions 13.x antérieures à 13.0.1 | ||
Typo3 | Typo3 | Typo3 versions 11.x antérieures à 11.5.35 | ||
Typo3 | Typo3 | Typo3 versions 12.x antérieures à 12.4.11 | ||
Typo3 | Typo3 | Typo3 versions 9.x antérieures à 9.5.46 | ||
Typo3 | Typo3 | Typo3 versions 8.x antérieures à 8.7.57 | ||
Typo3 | Typo3 | Typo3 versions 10.x antérieures à 10.4.43 |
Title | Publication Time | Tags | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "Typo3 versions 13.x ant\u00e9rieures \u00e0 13.0.1", "product": { "name": "Typo3", "vendor": { "name": "Typo3", "scada": false } } }, { "description": "Typo3 versions 11.x ant\u00e9rieures \u00e0 11.5.35", "product": { "name": "Typo3", "vendor": { "name": "Typo3", "scada": false } } }, { "description": "Typo3 versions 12.x ant\u00e9rieures \u00e0 12.4.11", "product": { "name": "Typo3", "vendor": { "name": "Typo3", "scada": false } } }, { "description": "Typo3 versions 9.x ant\u00e9rieures \u00e0 9.5.46", "product": { "name": "Typo3", "vendor": { "name": "Typo3", "scada": false } } }, { "description": "Typo3 versions 8.x ant\u00e9rieures \u00e0 8.7.57", "product": { "name": "Typo3", "vendor": { "name": "Typo3", "scada": false } } }, { "description": "Typo3 versions 10.x ant\u00e9rieures \u00e0 10.4.43", "product": { "name": "Typo3", "vendor": { "name": "Typo3", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2023-30451", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30451" }, { "name": "CVE-2024-25119", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25119" }, { "name": "CVE-2024-25118", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25118" }, { "name": "CVE-2024-22188", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22188" }, { "name": "CVE-2024-25120", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25120" }, { "name": "CVE-2024-25121", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25121" } ], "initial_release_date": "2024-02-13T00:00:00", "last_revision_date": "2024-02-13T00:00:00", "links": [], "reference": "CERTFR-2024-AVI-0121", "revisions": [ { "description": "Version initiale", "revision_date": "2024-02-13T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Typo3\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\net une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans Typo3", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Typo3 GHSA-wf85-8hx9-gj7c du 13 f\u00e9vrier 2024", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-wf85-8hx9-gj7c" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Typo3 GHSA-h47m-3f78-qp9g du 13 f\u00e9vrier 2024", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-h47m-3f78-qp9g" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Typo3 GHSA-w6x2-jg8h-p6mp du 13 f\u00e9vrier 2024", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-w6x2-jg8h-p6mp" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Typo3 GHSA-5w2h-59j3-8x5w du 13 f\u00e9vrier 2024", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-5w2h-59j3-8x5w" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Typo3 GHSA-38r2-5695-334w du 13 f\u00e9vrier 2024", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-38r2-5695-334w" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Typo3 GHSA-rj3x-wvc6-5j66 du 13 f\u00e9vrier 2024", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-rj3x-wvc6-5j66" } ] }
ghsa-w6x2-jg8h-p6mp
Vulnerability from github
Problem
Configurable storages using the local driver of the File Abstraction Layer (FAL) could be configured to access directories outside of the root directory of the corresponding project. The system setting in BE/lockRootPath
was not evaluated by the file abstraction layer component. An administrator-level backend user account is required to exploit this vulnerability.
Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
ℹ️ Strong security defaults - Manual actions required
see Important: #102800 changelog
Assuming that a web project is located in the directory /var/www/example.org
(the "project root path" for Composer-based projects) and the publicly accessible directory is located at /var/www/example.org/public
(the "public root path"), accessing resources via the File Abstraction Layer component is limited to the mentioned directories.
To grant additional access to directories, they must be explicitly configured in the system settings of $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath']
- either using the Install Tool or according to deployment techniques. The existing setting has been extended to support multiple directories configured as an array of strings.
Example:
php
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] = [
‘/var/shared/documents/’,
‘/var/shared/images/’,
];
❗ Storages that reference directories not explicitly granted will be marked as "offline" internally - no resources can be used in the website's frontend and backend context.
Credits
Thanks to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References
{ "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 8.7.56" }, "package": { "ecosystem": "Packagist", "name": "typo3/cms-core" }, "ranges": [ { "events": [ { "introduced": "8.0.0" }, { "fixed": "8.7.57" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 9.5.45" }, "package": { "ecosystem": "Packagist", "name": "typo3/cms-core" }, "ranges": [ { "events": [ { "introduced": "9.0.0" }, { "fixed": "9.5.46" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 10.4.42" }, "package": { "ecosystem": "Packagist", "name": "typo3/cms-core" }, "ranges": [ { "events": [ { "introduced": "10.0.0" }, { "fixed": "10.4.43" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 11.5.34" }, "package": { "ecosystem": "Packagist", "name": "typo3/cms-core" }, "ranges": [ { "events": [ { "introduced": "11.0.0" }, { "fixed": "11.5.35" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 12.4.10" }, "package": { "ecosystem": "Packagist", "name": "typo3/cms-core" }, "ranges": [ { "events": [ { "introduced": "12.0.0" }, { "fixed": "12.4.11" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Packagist", "name": "typo3/cms-core" }, "ranges": [ { "events": [ { "introduced": "13.0.0" }, { "fixed": "13.0.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "13.0.0" ] } ], "aliases": [ "CVE-2023-30451" ], "database_specific": { "cwe_ids": [ "CWE-22" ], "github_reviewed": true, "github_reviewed_at": "2024-02-13T19:08:10Z", "nvd_published_at": null, "severity": "MODERATE" }, "details": "### Problem\nConfigurable storages using the local driver of the File Abstraction Layer (FAL) could be configured to access directories outside of the root directory of the corresponding project. The system setting in `BE/lockRootPath` was not evaluated by the file abstraction layer component. An administrator-level backend user account is required to exploit this vulnerability.\n\n### Solution\nUpdate to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.\n\n#### \u2139\ufe0f **Strong security defaults - Manual actions required**\n\n_see [Important: #102800 changelog](https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/11.5.x/Important-102800-FileAbstractionLayerEnforcesAbsolutePathsToMatchProjectRootOrLockRootPath.html)_\n\nAssuming that a web project is located in the directory `/var/www/example.org` (the \"project root path\" for Composer-based projects) and the publicly accessible directory is located at `/var/www/example.org/public` (the \"public root path\"), accessing resources via the File Abstraction Layer component is limited to the mentioned directories.\n\nTo grant additional access to directories, they must be explicitly configured in the system settings of `$GLOBALS[\u0027TYPO3_CONF_VARS\u0027][\u0027BE\u0027][\u0027lockRootPath\u0027]` - either using the Install Tool or according to deployment techniques. The existing setting has been extended to support multiple directories configured as an array of strings.\n\nExample:\n```php\n$GLOBALS[\u0027TYPO3_CONF_VARS\u0027][\u0027BE\u0027][\u0027lockRootPath\u0027] = [\n \u2018/var/shared/documents/\u2019,\n \u2018/var/shared/images/\u2019,\n];\n```\n\n\u2757 **Storages that reference directories not explicitly granted will be marked as \"offline\" internally - no resources can be used in the website\u0027s frontend and backend context.**\n\n### Credits\nThanks to TYPO3 core \u0026 security team members Oliver Hader and Benjamin Franzke who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2024-001](https://typo3.org/security/advisory/typo3-core-sa-2024-001)\n", "id": "GHSA-w6x2-jg8h-p6mp", "modified": "2024-02-20T15:17:43Z", "published": "2024-02-13T19:08:10Z", "references": [ { "type": "WEB", "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-w6x2-jg8h-p6mp" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30451" }, { "type": "WEB", "url": "https://github.com/TYPO3/typo3/commit/205115cca3d67594a12d0195c937da0e51eb494a" }, { "type": "WEB", "url": "https://github.com/TYPO3/typo3/commit/78fb9287a2f0487c39288070cb0493a5265f1789" }, { "type": "WEB", "url": "https://github.com/TYPO3/typo3/commit/accf537c7379b4359bc0f957c4d0c07baddd710a" }, { "type": "PACKAGE", "url": "https://github.com/TYPO3/typo3" }, { "type": "WEB", "url": "https://typo3.org/security/advisory/typo3-core-sa-2024-001" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Path Traversal in TYPO3 File Abstraction Layer Storages" }
fkie_cve-2023-30451
Vulnerability from fkie_nvd
URL | Tags | ||
---|---|---|---|
cve@mitre.org | http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html | Third Party Advisory, VDB Entry |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:typo3:typo3:11.5.24:*:*:*:*:*:*:*", "matchCriteriaId": "39861941-0E9B-46A9-9C88-4886FEE7C544", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF]." }, { "lang": "es", "value": "En TYPO3 11.5.24, el componente filelist permite a los atacantes (que tienen acceso al panel de administrador) leer archivos arbitrarios a trav\u00e9s del directory traversal en el campo baseuri, como lo demuestra POST /typo3/record/edit con ../../. ./ en datos[sys_file_storage]*[datos][sDEF][lDEF][basePath][vDEF]." } ], "id": "CVE-2023-30451", "lastModified": "2024-11-21T08:00:12.673", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2023-12-25T05:15:08.553", "references": [ { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-22" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.