GHSA-c7rj-92xr-wprg
Insecure Unserialize in TYPO3 Backend
Medium
Packagist
- Severity
- 5.0 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
6.2.29- Upgrade typo3/cms to this version or later
Description
Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| typo3/cms | >= 6.2.0, < 6.2.29 |
6.2.29 |
| typo3/cms | >= 7.6.0, < 7.6.13 |
7.6.13 |
| typo3/cms | >= 8.0.0, < 8.4.1 |
8.4.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
typo3/cms Packagist → 6.2.29
- composer
composer require typo3/cms:^6.2.29
Severity breakdown
CVSS 3.1 5.0
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
References
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling | Medium | Also affects typo3/cms |
| GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool | Medium | Also affects typo3/cms |
| GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie | High | Also affects typo3/cms |
| GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login | Medium | Also affects typo3/cms |
| GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component | Medium | Also affects typo3/cms |
| GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering | Medium | Also affects typo3/cms |
| GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module | High | Also affects typo3/cms |
| GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration | High | Also affects typo3/cms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor