TYPO3 Content Editing Wizards Arbitrary File Deletion Vulnerability

Bugtraq ID:	64256
Class:	Input Validation Error
CVE:	CVE-2013-7075
Remote:	Yes
Local:	No
Published:	Dec 10 2013 12:00AM
Updated:	Jan 02 2014 12:32AM
Credit:	Rupert Germann
Vulnerable:	Typo3 Typo3 4.5.13 Typo3 Typo3 4.5.8 Typo3 Typo3 4.5.7 Typo3 Typo3 4.5.5 Typo3 Typo3 4.5.9 Typo3 Typo3 4.5.6 Typo3 Typo3 4.5.4 Typo3 Typo3 4.5.3 Typo3 Typo3 4.5.2 Typo3 Typo3 4.5.15 Typo3 Typo3 4.5.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

TYPO3 Content Editing Wizards Arbitrary File Deletion Vulnerability

TYPO3 is prone to a vulnerability that lets attackers delete arbitrary files on an affected computer in the context of the web server.

An attacker can exploit this issue to delete arbitrary files on a vulnerable computer in the context of the web server.

This issue is fixed in TYPO3 4.5.32, 4.7.17, 6.0.12 and 6.1.7.

TYPO3 Content Editing Wizards Arbitrary File Deletion Vulnerability

The vendor reports that they are aware of working exploit. This exploit is not otherwise publicly available or known to be circulating in the wild.

TYPO3 Content Editing Wizards Arbitrary File Deletion Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

TYPO3 Content Editing Wizards Arbitrary File Deletion Vulnerability

References:

• TYPO3 Homepage (TYPO3)