Typo3 Phar-Stream-Wrapper vulnerabilities

2 known vulnerabilities affecting typo3/phar-stream-wrapper.

Total CVEs

2

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL2

Vulnerabilities

Page 1 of 1

CVE-2019-11830CRITICAL≥ 2.0.0, < 2.1.1≥ 3.0.0, < 3.1.12022-05-24

CVE-2019-11830 [CRITICAL] CWE-502 PharStreamWrapper for Typo3 unsafe deserialization vulnerability PharStreamWrapper for Typo3 unsafe deserialization vulnerability PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.

CVE-2019-11831CRITICAL≥ 2.0.0, < 2.1.1≥ 3.0.0, < 3.1.12021-09-30

CVE-2019-11831 [CRITICAL] CWE-22 Directory Traversal in typo3/phar-stream-wrapper Directory Traversal in typo3/phar-stream-wrapper The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.