CVE-2011-4904
published 2019-11-06CVE-2011-4904: TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.14%
62.6th percentile
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 0 < 4.4.9 | 4.4.9 |
| typo3 | cms | >= 4.5.0 < 4.5.4 | 4.5.4 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | >= 4.4.0 < 4.4.9 | 4.4.9 |
| typo3 | typo3 | >= 4.5.0 < 4.5.4 | 4.5.4 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Typo3 Improper Access Control
osv·2022-04-22
CVE-2011-4904 [MEDIUM] Typo3 Improper Access Control
Typo3 Improper Access Control
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
GHSA
Typo3 Improper Access Control
ghsa·2022-04-22
CVE-2011-4904 [MEDIUM] CWE-20 Typo3 Improper Access Control
Typo3 Improper Access Control
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-11-06
Published