Skip to content
OpenAdvisories
Medium · 6.5 CVE-2011-4902 EUVD-2022-1695GHSA-9vxq-mxw5-mcgp

Typo3 Arbitrary File Delete

Published Nov 6, 2019 · Updated Aug 7, 2024 · Assigned by redhat

Description

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.

Affected products

VendorProductAffectedFixed
TYPO3 TYPO3 before 4.5.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 6.0 typo3-src 4.3.9+dfsg1-1+squeeze1 DSA-2289-1
Debian 5.0 typo3-src 4.2.5-1+lenny8 DSA-2289-1

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist typo3/cms < 4.3.12 4.3.12 GHSA-9vxq-mxw5-mcgp
Packagist typo3/cms >= 4.4.0, < 4.4.9 4.4.9 GHSA-9vxq-mxw5-mcgp
Packagist typo3/cms >= 4.5.0, < 4.5.4 4.5.4 GHSA-9vxq-mxw5-mcgp

Advisories 1

References