CVE-2013-4250
published 2014-05-20CVE-2013-4250: The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions…
PriorityP434medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
1.15%
62.9th percentile
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 6.0.0 < 6.0.9 | 6.0.9 |
| typo3 | cms | >= 6.0.0 < 6.0.8 | 6.0.8 |
| typo3 | cms | >= 6.1.0 < 6.1.4 | 6.1.4 |
| typo3 | cms | >= 6.1.0 < 6.1.3 | 6.1.3 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa6.5MEDIUM
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
TYPO3 vulnerable to remote authenticated arbitrary code execution
osv·2022-05-17·CVSS 6.5
CVE-2013-4321 [MEDIUM] TYPO3 vulnerable to remote authenticated arbitrary code execution
TYPO3 vulnerable to remote authenticated arbitrary code execution
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.
OSV
TYPO3 doesn't properly check file extensions
osv·2022-05-17
CVE-2013-4250 [HIGH] TYPO3 doesn't properly check file extensions
TYPO3 doesn't properly check file extensions
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
GHSA
TYPO3 vulnerable to remote authenticated arbitrary code execution
ghsa·2022-05-17·CVSS 6.5
CVE-2013-4321 [MEDIUM] CWE-94 TYPO3 vulnerable to remote authenticated arbitrary code execution
TYPO3 vulnerable to remote authenticated arbitrary code execution
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.
GHSA
TYPO3 doesn't properly check file extensions
ghsa·2022-05-17
CVE-2013-4250 [HIGH] CWE-20 TYPO3 doesn't properly check file extensions
TYPO3 doesn't properly check file extensions
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2014-05-20
Published