webcoast-dk/deferred-image-processing · Security
Improper Resource Shutdown or Release in TYPO3 extension
- GHSA ID
- GHSA-34jq-548x-m2x9
- CVE ID
- CVE-2021-38623
- Severity
- high
- Published
- Updated
- CVSS
- 7 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C
- CVSS v3
- 7 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C
Description
Wrong usage of the TYPO3 FAL API results in copies of processed files being saved to the /var/transient/ folder of a TYPO3 website on every frontend request. This can result in Denial of Service, since the webspace may be filled up with image files simply by crafting a large amount of requests to the website.
CWEs
- CWE-404 · Improper Resource Shutdown or Release