Lucene search

[email protected]CVE-2015-4606

HistoryJun 16, 2015 - 4:59 p.m.

CVE-2015-4606

2015-06-1616:59:05

[email protected]

web.nvd.nist.gov

typo3

cve-2015-4606

file upload

vulnerability

remote code execution

mod_mime

job fair extension

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8 High

AI Score

Confidence

Low

0.027 Low

EPSS

Percentile

90.6%

JSON

Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder.

Affected configurations

NVD

Node

job_fair_projectjob_fairRange≤1.0.0typo3

CPENameOperatorVersion
job_fair_project:job_fairjob fair project job fairle1.0.0

CPE	Name	Operator	Version
job_fair_project:job_fair	job fair project job fair	le	1.0.0

References

typo3.org/extensions/repository/view/jobfair

typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-013/

www.securityfocus.com/bid/75238

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8 High

AI Score

Confidence

Low

0.027 Low

EPSS

Percentile

90.6%

JSON

Related for CVE-2015-4606

cvelist1 nvd1 prion1