Description
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms-core | >= 8.0.0, < 8.7.57 | 8.7.57 | GHSA-5w2h-59j3-8x5w |
| Packagist | typo3/cms-core | >= 9.0.0, < 9.5.46 | 9.5.46 | GHSA-5w2h-59j3-8x5w |
| Packagist | typo3/cms-core | >= 10.0.0, < 10.4.43 | 10.4.43 | GHSA-5w2h-59j3-8x5w |
| Packagist | typo3/cms-core | >= 11.0.0, < 11.5.35 | 11.5.35 | GHSA-5w2h-59j3-8x5w |
| Packagist | typo3/cms-core | >= 12.0.0, < 12.4.11 | 12.4.11 | GHSA-5w2h-59j3-8x5w |
| Packagist | typo3/cms-core | >= 13.0.0, < 13.0.1 | 13.0.1 | GHSA-5w2h-59j3-8x5w |
Advisories 1
- WID-SEC-2024-0357 TYPO3 Core und TYPO3 Extension: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 12, 2024