SB2017090719 - Multiple vulnerabilities in TYPO3

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017090719

SB2017090719 - Multiple vulnerabilities in TYPO3

Published: September 7, 2017 Updated: September 7, 2017

Security Bulletin ID SB2017090719
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Remote code execution (CVE-ID: CVE-2017-14251)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]


The vulnerability allows a remote authenticated attacker to execute arbitrary code.

The weakness exists due to the fileDenyPattern is missing the 'pht' extension. A remote attacker can upload a '.pht' file and potentially execute arbitrary code on the target system, depending on the web server configuration.

2) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The weakness exists due to improper check of user permissions on file storage. A remote attacker with editor privileges can gain access to arbitrary data on the target system.

3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


4) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to insufficient validation of user-supplied data. A remote attacker can send a specially crafted HTTP request to the TYPO3 API, trick the victim into opening it and view potentially sensitive version information on the target system.

Remediation

Install update from vendor's website.

References