TYPO3 PharStreamWrapper Package CVE-2019-11831 Directory Traversal Vulnerability
BID:108302
CVE-2019-11831 |Info
TYPO3 PharStreamWrapper Package CVE-2019-11831 Directory Traversal Vulnerability
| Bugtraq ID: | 108302 |
| Class: | Input Validation Error |
| CVE: |
CVE-2019-11831 |
| Remote: | Yes |
| Local: | No |
| Published: | May 08 2019 12:00AM |
| Updated: | May 08 2019 12:00AM |
| Credit: | Daniel le Gall |
| Vulnerable: |
Typo3 PharStreamWrapper 3.1 Typo3 PharStreamWrapper 3.0 Typo3 PharStreamWrapper 2.1 Typo3 PharStreamWrapper 2.0 Drupal Drupal 8.7 Drupal Drupal 8.6.15 Drupal Drupal 8.6.13 Drupal Drupal 8.6.10 Drupal Drupal 8.6.6 Drupal Drupal 8.6.5 Drupal Drupal 8.6.4 Drupal Drupal 8.6.3 Drupal Drupal 8.6.2 Drupal Drupal 8.6.1 Drupal Drupal 8.6 Drupal Drupal 7.9 Drupal Drupal 7.8 Drupal Drupal 7.66 Drupal Drupal 7.65 Drupal Drupal 7.62 Drupal Drupal 7.6 Drupal Drupal 7.59 Drupal Drupal 7.58 Drupal Drupal 7.57 Drupal Drupal 7.56 Drupal Drupal 7.55 Drupal Drupal 7.54 Drupal Drupal 7.52 Drupal Drupal 7.5 Drupal Drupal 7.44 Drupal Drupal 7.43 Drupal Drupal 7.42 Drupal Drupal 7.41 Drupal Drupal 7.40 Drupal Drupal 7.4 Drupal Drupal 7.39 Drupal Drupal 7.38 Drupal Drupal 7.37 Drupal Drupal 7.36 Drupal Drupal 7.35 Drupal Drupal 7.34 Drupal Drupal 7.33 Drupal Drupal 7.32 Drupal Drupal 7.31 Drupal Drupal 7.30 Drupal Drupal 7.3 Drupal Drupal 7.29 Drupal Drupal 7.28 Drupal Drupal 7.27 Drupal Drupal 7.26 Drupal Drupal 7.25 Drupal Drupal 7.24 Drupal Drupal 7.23 Drupal Drupal 7.22 Drupal Drupal 7.21 Drupal Drupal 7.20 Drupal Drupal 7.2 Drupal Drupal 7.19 Drupal Drupal 7.18 Drupal Drupal 7.17 Drupal Drupal 7.16 Drupal Drupal 7.15 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 |
| Not Vulnerable: |
Typo3 PharStreamWrapper 3.1.1 Typo3 PharStreamWrapper 2.1.1 Drupal Drupal 8.7.1 Drupal Drupal 8.6.16 Drupal Drupal 7.67 |
Discussion
TYPO3 PharStreamWrapper Package CVE-2019-11831 Directory Traversal Vulnerability
The PharStreamWrapper package for TYPO3 is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to write or retrieve arbitrary files from the affected system in the context of the application or bypass certain security restrictions. Information obtained could aid in further attacks.
Versions prior to PharStreamWrapper 2.1.1 and 3.1.1 are vulnerable.
The PharStreamWrapper package for TYPO3 is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to write or retrieve arbitrary files from the affected system in the context of the application or bypass certain security restrictions. Information obtained could aid in further attacks.
Versions prior to PharStreamWrapper 2.1.1 and 3.1.1 are vulnerable.
Solution / Fix
TYPO3 PharStreamWrapper Package CVE-2019-11831 Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
TYPO3 PharStreamWrapper Package CVE-2019-11831 Directory Traversal Vulnerability
References:
References: