GitHub Advisory DatabaseGHSA-77P4-WFR8-977WTYPO3 Directory Traversal on ZIP extraction
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
55.5%
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| typo3/cms | lt | 9.5.12 | |
| typo3/cms | lt | 8.7.30 | |
| typo3/cms | lt | 10.2.2 | |
| typo3/cms-core | lt | 9.5.12 | |
| typo3/cms-core | lt | 8.7.30 | |
| typo3/cms-core | lt | 10.2.2 |
References
github.com/advisories/GHSA-77p4-wfr8-977w
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-19848.yaml
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-19848.yaml
nvd.nist.gov/vuln/detail/CVE-2019-19848
review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security
typo3.org/security/advisory/typo3-core-sa-2019-024
typo3.org/security/advisory/typo3-core-sa-2019-024/
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
55.5%