typo3-cms/backend · Security
TYPO3 Arbitrary Code Execution vulnerability on the backend
- GHSA ID
- GHSA-wjpc-gjf7-9938
- CVE ID
- CVE-2010-3663
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
CWEs
- CWE-434 · Unrestricted Upload of File with Dangerous Type