in2code-de/powermail · Security
TYPO3 powermail extension has unrestricted file upload vulnerability
- GHSA ID
- GHSA-m278-c6gg-4jrr
- CVE ID
- CVE-2014-3947
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Description
Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')