CVE-2008-2717
published 2008-06-16CVE-2008-2717: TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows…
PriorityP337medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
3.02%
85.8th percentile
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms-core | >= 4.0.0 < 4.0.9 | 4.0.9 |
| typo3 | cms-core | >= 4.1.0 < 4.1.7 | 4.1.7 |
| typo3 | cms-core | >= 4.2.0 < 4.2.1 | 4.2.1 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
TYPO3 Unrestricted File Upload vulnerability
osv·2022-05-01
CVE-2008-2717 [MEDIUM] TYPO3 Unrestricted File Upload vulnerability
TYPO3 Unrestricted File Upload vulnerability
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
GHSA
TYPO3 Unrestricted File Upload vulnerability
ghsa·2022-05-01
CVE-2008-2717 [MEDIUM] CWE-434 TYPO3 Unrestricted File Upload vulnerability
TYPO3 Unrestricted File Upload vulnerability
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/http://secunia.com/advisories/30619http://secunia.com/advisories/30660http://securityreason.com/securityalert/3945http://typo3.org/teams/security/security-bulletins/typo3-20080611-1/http://www.debian.org/security/2008/dsa-1596http://www.securityfocus.com/archive/1/493270/100/0/threadedhttp://www.securityfocus.com/bid/29657http://www.vupen.com/english/advisories/2008/1802https://exchange.xforce.ibmcloud.com/vulnerabilities/42988http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/http://secunia.com/advisories/30619http://secunia.com/advisories/30660http://securityreason.com/securityalert/3945http://typo3.org/teams/security/security-bulletins/typo3-20080611-1/http://www.debian.org/security/2008/dsa-1596http://www.securityfocus.com/archive/1/493270/100/0/threadedhttp://www.securityfocus.com/bid/29657http://www.vupen.com/english/advisories/2008/1802https://exchange.xforce.ibmcloud.com/vulnerabilities/42988
2008-06-16
Published