CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
70.5%
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
Vendor | Product | Version | CPE |
---|---|---|---|
apache | apache_webserver | * | cpe:2.3:a:apache:apache_webserver:*:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0 | cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.1 | cpe:2.3:a:typo3:typo3:4.0.1:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.2 | cpe:2.3:a:typo3:typo3:4.0.2:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.3 | cpe:2.3:a:typo3:typo3:4.0.3:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.4 | cpe:2.3:a:typo3:typo3:4.0.4:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.5 | cpe:2.3:a:typo3:typo3:4.0.5:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.6 | cpe:2.3:a:typo3:typo3:4.0.6:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.7 | cpe:2.3:a:typo3:typo3:4.0.7:*:*:*:*:*:*:* |
typo3 | typo3 | 4.0.8 | cpe:2.3:a:typo3:typo3:4.0.8:*:*:*:*:*:*:* |
buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/
secunia.com/advisories/30619
secunia.com/advisories/30660
securityreason.com/securityalert/3945
typo3.org/teams/security/security-bulletins/typo3-20080611-1/
www.debian.org/security/2008/dsa-1596
www.securityfocus.com/archive/1/493270/100/0/threaded
www.securityfocus.com/bid/29657
www.vupen.com/english/advisories/2008/1802
exchange.xforce.ibmcloud.com/vulnerabilities/42988