CVE-2008-2717
6.7 Medium
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
69.1%
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
Affected configurations
References
buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/
secunia.com/advisories/30619
secunia.com/advisories/30660
securityreason.com/securityalert/3945
typo3.org/teams/security/security-bulletins/typo3-20080611-1/
www.debian.org/security/2008/dsa-1596
www.securityfocus.com/archive/1/493270/100/0/threaded
www.securityfocus.com/bid/29657
www.vupen.com/english/advisories/2008/1802
exchange.xforce.ibmcloud.com/vulnerabilities/42988
Related
6.7 Medium
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
69.1%