TYPO3 Cross Site Request Forgery Vulnerability

Bugtraq ID:	46377
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 15 2011 12:00AM
Updated:	Feb 15 2011 12:00AM
Credit:	Sven Taute
Vulnerable:	Typo3 Typo3 4.4.1 Typo3 Typo3 4.4 Typo3 Typo3 4.3.3 Typo3 Typo3 4.3.2 Typo3 Typo3 4.3.1 Typo3 Typo3 4.3 Typo3 Typo3 4.2.12 Typo3 Typo3 4.2.11 Typo3 Typo3 4.2.10 Typo3 Typo3 4.2.9 Typo3 Typo3 4.2.6 Typo3 Typo3 4.2.4 Typo3 Typo3 4.2.3 Typo3 Typo3 4.2.2 Typo3 Typo3 4.2.1 Typo3 Typo3 4.2 Typo3 Typo3 4.4.5 Typo3 Typo3 4.4.4 Typo3 Typo3 4.4.3 Typo3 Typo3 4.3beta2 Typo3 Typo3 4.3.9 Typo3 Typo3 4.3.7 Typo3 Typo3 4.3.6 Typo3 Typo3 4.3.4 Typo3 Typo3 4.3.0beta1 Typo3 Typo3 4.2.16 Typo3 Typo3 4.2.15 Typo3 Typo3 4.2.14 Typo3 Typo3 4.2.13
Not Vulnerable:	Typo3 Typo3 4.5

TYPO3 Cross Site Request Forgery Vulnerability

TYPO3 is prone to an unspecified cross-site request-forgery vulnerability because it fails to properly validate requests.

Attackers may exploit this issue to perform unauthorized actions by enticing a logged-in user to visit a malicious site.

TYPO3 4.2, 4.3, and 4.4 are vulnerable; other versions may also be affected.

TYPO3 Cross Site Request Forgery Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

TYPO3 Cross Site Request Forgery Vulnerability

Solution:
The vendor released an update. Please see the references for details.

TYPO3 Cross Site Request Forgery Vulnerability

References:

• TYPO3 4.5 Release Notes (TYPO3)
  
• TYPO3 Homepage (TYPO3)