#VU42210 Permissions, Privileges, and Access Controls in TYPO3 - CVE-2013-7073

Vulnerability identifier: #VU42210

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2013-7073

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
TYPO3
Web applications / CMS

Vendor: TYPO3

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.

Mitigation
Install update from vendor's website.

Vulnerable software versions

TYPO3: 4.5.0 - 4.7.16, 6.0 - 6.1.6

---

External links
https://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html
https://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html
https://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
https://seclists.org/oss-sec/2013/q4/473
https://seclists.org/oss-sec/2013/q4/487
https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/
https://www.debian.org/security/2014/dsa-2834

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.