CVE-2013-7075
published 2013-12-23CVE-2013-7075: The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote…
PriorityP433medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
1.27%
66.2th percentile
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
Affected
72 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 4.5.0 < 4.5.32 | 4.5.32 |
| typo3 | cms | >= 4.7.0 < 4.7.17 | 4.7.17 |
| typo3 | cms | >= 6.0.0 < 6.0.12 | 6.0.12 |
| typo3 | cms | >= 6.1.0 < 6.1.7 | 6.1.7 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
osv·2022-05-17
CVE-2013-7075 [MEDIUM] TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
GHSA
TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
ghsa·2022-05-17
CVE-2013-7075 [MEDIUM] CWE-502 TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
OSV
CVE-2013-7075: The Content Editing Wizards component in TYPO3 4
osv·2013-12-23·CVSS 6.5
CVE-2013-7075 [MEDIUM] CVE-2013-7075: The Content Editing Wizards component in TYPO3 4
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://seclists.org/oss-sec/2013/q4/473http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/http://www.debian.org/security/2014/dsa-2834http://seclists.org/oss-sec/2013/q4/473http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/http://www.debian.org/security/2014/dsa-2834
2013-12-23
Published