CVE-2010-3663 — Unrestricted File Upload in Typo3

CWE-434 — Unrestricted File Upload8 documents5 sources
Severity
8.8HIGHNVD
EPSS
3.0%
top 13.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Typo3Typo3 Cms-backend
Timeline
PublishedNov 4
Latest updateApr 21

Description

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶Packagisttypo3/cms-backend4.2 — 4.2.13+3
▶NVDtypo3/typo34.2.0 — 4.2.13+3

🔴Vulnerability Details

3
GHSA
TYPO3 Arbitrary Code Execution vulnerability on the backend↗2022-04-21
▶
OSV
TYPO3 Arbitrary Code Execution vulnerability on the backend↗2022-04-21
▶
CVEList
CVE-2010-3663: TYPO3 before 4↗2019-11-04
▶

💬Community

4
Bugzilla
CVE-2010-3663 php-typo3-phar-stream-wrapper: insecure default value of fileDenyPattern can lead to code execution on the backend [fedora-all]↗2019-11-12
▶
Bugzilla
CVE-2010-3663 php-typo3-phar-stream-wrapper2: php-typo3-phar-stream-wrapper: insecure default value of fileDenyPattern can lead to code execution on the backend [fedora-all]↗2019-11-12
▶
Bugzilla
CVE-2010-3663 php-typo3-phar-stream-wrapper: insecure default value of fileDenyPattern can lead to code execution on the backend↗2019-11-12
▶
Bugzilla
CVE-2010-3663 php-typo3-phar-stream-wrapper2: php-typo3-phar-stream-wrapper: insecure default value of fileDenyPattern can lead to code execution on the backend [epel-7]↗2019-11-12
▶
CVE-2010-3663 — Unrestricted File Upload in Typo3 | cvebase