CVE-2012-1605
published 2012-09-04CVE-2012-1605: The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects…
PriorityP430medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
2.37%
81.7th percentile
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 4.4.0 < 4.4.14 | 4.4.14 |
| typo3 | cms | >= 4.5.0 < 4.5.14 | 4.5.14 |
| typo3 | cms | >= 4.6 < 4.6.7 | 4.6.7 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Typo3 Extbase Framework Unsafe Deserialization
ghsa·2022-05-17
CVE-2012-1605 [MEDIUM] CWE-502 Typo3 Extbase Framework Unsafe Deserialization
Typo3 Extbase Framework Unsafe Deserialization
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
OSV
Typo3 Extbase Framework Unsafe Deserialization
osv·2022-05-17
CVE-2012-1605 [MEDIUM] Typo3 Extbase Framework Unsafe Deserialization
Typo3 Extbase Framework Unsafe Deserialization
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/http://www.openwall.com/lists/oss-security/2012/03/30/4http://www.osvdb.org/80759http://www.securityfocus.com/bid/52771http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/http://www.openwall.com/lists/oss-security/2012/03/30/4http://www.osvdb.org/80759http://www.securityfocus.com/bid/52771
2012-09-04
Published