Lucene search

MitreCVE-2009-0815

HistoryMar 05, 2009 - 2:30 a.m.

CVE-2009-0815

2009-03-0502:30:00

CWE-200

mitre

web.nvd.nist.gov

cve-2009-0815

typo3

class.tslib_fe.php

security vulnerability

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.184

Percentile

96.3%

JSON

The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.

Affected configurations

Nvd

Node

typo3typo3Match3.3.x

typo3typo3Match3.5.x

typo3typo3Match3.6.x

typo3typo3Match3.7.x

typo3typo3Match3.8.x

typo3typo3Match4.0

typo3typo3Match4.1

typo3typo3Match4.1.0

typo3typo3Match4.1.2

typo3typo3Match4.1.3

typo3typo3Match4.1.4

typo3typo3Match4.1.5

typo3typo3Match4.1.6

typo3typo3Match4.1.7

typo3typo3Match4.1.8

typo3typo3Match4.1.9

typo3typo3Match4.2

typo3typo3Match4.2.0

typo3typo3Match4.2.1

typo3typo3Match4.2.2

typo3typo3Match4.2.3

typo3typo3Match4.2.4

typo3typo3Match4.2.5

typo3typo3Match4.3alpha1

VendorProductVersionCPE
typo3typo33.3.xcpe:2.3:a:typo3:typo3:3.3.x:*:*:*:*:*:*:*
typo3typo33.5.xcpe:2.3:a:typo3:typo3:3.5.x:*:*:*:*:*:*:*
typo3typo33.6.xcpe:2.3:a:typo3:typo3:3.6.x:*:*:*:*:*:*:*
typo3typo33.7.xcpe:2.3:a:typo3:typo3:3.7.x:*:*:*:*:*:*:*
typo3typo33.8.xcpe:2.3:a:typo3:typo3:3.8.x:*:*:*:*:*:*:*
typo3typo34.0cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*
typo3typo34.1cpe:2.3:a:typo3:typo3:4.1:*:*:*:*:*:*:*
typo3typo34.1.0cpe:2.3:a:typo3:typo3:4.1.0:*:*:*:*:*:*:*
typo3typo34.1.2cpe:2.3:a:typo3:typo3:4.1.2:*:*:*:*:*:*:*
typo3typo34.1.3cpe:2.3:a:typo3:typo3:4.1.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3	3.3.x	cpe:2.3:a:typo3:typo3:3.3.x:::::::*
typo3	typo3	3.5.x	cpe:2.3:a:typo3:typo3:3.5.x:::::::*
typo3	typo3	3.6.x	cpe:2.3:a:typo3:typo3:3.6.x:::::::*
typo3	typo3	3.7.x	cpe:2.3:a:typo3:typo3:3.7.x:::::::*
typo3	typo3	3.8.x	cpe:2.3:a:typo3:typo3:3.8.x:::::::*
typo3	typo3	4.0	cpe:2.3:a:typo3:typo3:4.0:::::::*
typo3	typo3	4.1	cpe:2.3:a:typo3:typo3:4.1:::::::*
typo3	typo3	4.1.0	cpe:2.3:a:typo3:typo3:4.1.0:::::::*
typo3	typo3	4.1.2	cpe:2.3:a:typo3:typo3:4.1.2:::::::*
typo3	typo3	4.1.3	cpe:2.3:a:typo3:typo3:4.1.3:::::::*