Multiple vulnerabilities in TYPO3

Published: 2014-05-20 | Updated: 2020-08-10

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2013-4320 CVE-2013-4321
CWE-ID	CWE-264 CWE-94
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	TYPO3 Web applications / CMS
Vendor	TYPO3

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU41655

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2013-4320

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote #AU# to read and manipulate data.

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

Mitigation

Install update from vendor's website.

Vulnerable software versions

TYPO3: 6.0 - 6.1.3

CPE2.3

External links

https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU41656