TYPO3 OpenID Extension Open Redirection Vulnerability

Bugtraq ID:	64252
Class:	Input Validation Error
CVE:	CVE-2013-7079
Remote:	Yes
Local:	No
Published:	Dec 10 2013 12:00AM
Updated:	Jan 02 2014 12:54AM
Credit:	Georg Ringer
Vulnerable:	Typo3 Typo3 4.5.13 Typo3 Typo3 4.5.8 Typo3 Typo3 4.5.7 Typo3 Typo3 4.5.5 Typo3 Typo3 4.5.9 Typo3 Typo3 4.5.6 Typo3 Typo3 4.5.4 Typo3 Typo3 4.5.3 Typo3 Typo3 4.5.2 Typo3 Typo3 4.5.15 Typo3 Typo3 4.5.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

TYPO3 OpenID Extension Open Redirection Vulnerability

TYPO3 is prone to an open-redirection vulnerability.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

This issue is fixed in TYPO3 4.5.32, 4.7.17, 6.0.12, and 6.1.7

TYPO3 OpenID Extension Open Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

TYPO3 OpenID Extension Open Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

TYPO3 OpenID Extension Open Redirection Vulnerability

References:

• TYPO3 Homepage (TYPO3)