TYPO3 Core TYPO3-SA-2010-022 Multiple Remote Security Vulnerabilities
BID:45470
Info
TYPO3 Core TYPO3-SA-2010-022 Multiple Remote Security Vulnerabilities
| Bugtraq ID: | 45470 |
| Class: | Unknown |
| CVE: |
CVE-2010-5097 CVE-2010-5104 CVE-2010-5103 CVE-2010-5102 CVE-2010-5101 CVE-2010-5100 CVE-2010-5098 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2010 12:00AM |
| Updated: | Apr 13 2015 09:05PM |
| Credit: | Andreas Weber, Security Team Member Helmut Hummel, Gregor Kopf and Luca Carettoni, Fabrizio Branca, Anthon Pang, Security Team Member Marcus Krause, and the vendor |
| Vulnerable: |
Typo3 Typo3 4.4.1 Typo3 Typo3 4.4 Typo3 Typo3 4.3.3 Typo3 Typo3 4.3.2 Typo3 Typo3 4.3.1 Typo3 Typo3 4.3 Typo3 Typo3 4.2.12 Typo3 Typo3 4.2.11 Typo3 Typo3 4.2.10 Typo3 Typo3 4.2.9 Typo3 Typo3 4.2.6 Typo3 Typo3 4.2.4 Typo3 Typo3 4.2.3 Typo3 Typo3 4.2.2 Typo3 Typo3 4.2.1 Typo3 Typo3 4.2 Typo3 Typo3 4.4.4 Typo3 Typo3 4.4.3 Typo3 Typo3 4.3.7 Typo3 Typo3 4.3.6 Typo3 Typo3 4.3.4 Typo3 Typo3 4.2.15 Typo3 Typo3 4.2.14 Typo3 Typo3 4.2.13 |
| Not Vulnerable: |
Typo3 Typo3 4.4.5 Typo3 Typo3 4.3.9 Typo3 Typo3 4.2.16 |
Discussion
TYPO3 Core TYPO3-SA-2010-022 Multiple Remote Security Vulnerabilities
TYPO3 is prone to multiple remote vulnerabilities, including:
A cross-site scripting vulnerability,
Information-disclosure vulnerabilities,
An SQL-injection vulnerability,
HTML-injection vulnerabilities,
A PHP file-include vulnerability,
A directory-traversal vulnerability.
Successful exploitation may allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the website, steal cookie-based credentials, include and execute arbitrary PHP code, disclose sensitive information, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible.
The follow versions are affected:
TYPO3 4.2.15 and prior
TYPO3 4.3.8 and prior
TYPO3 4.4.4 and prior
TYPO3 is prone to multiple remote vulnerabilities, including:
A cross-site scripting vulnerability,
Information-disclosure vulnerabilities,
An SQL-injection vulnerability,
HTML-injection vulnerabilities,
A PHP file-include vulnerability,
A directory-traversal vulnerability.
Successful exploitation may allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the website, steal cookie-based credentials, include and execute arbitrary PHP code, disclose sensitive information, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible.
The follow versions are affected:
TYPO3 4.2.15 and prior
TYPO3 4.3.8 and prior
TYPO3 4.4.4 and prior
Exploit / POC
TYPO3 Core TYPO3-SA-2010-022 Multiple Remote Security Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting victim to follow a malicious URI.
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
TYPO3 Core TYPO3-SA-2010-022 Multiple Remote Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
TYPO3 Core TYPO3-SA-2010-022 Multiple Remote Security Vulnerabilities
References:
References: