TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts

2024-05-3021:02:59

Google

osv.dev

typo3

editors

metadata

file mounts

security vulnerability

7.1 High

AI Score

Confidence

Low

JSON

It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.

CPENameOperatorVersion
typo3/cmseq6.2.10-rc1
typo3/cmseq6.2.6
typo3/cmseq7.0.0
typo3/cmseq6.2.13
typo3/cmseq7.0.1
typo3/cmseq6.2.1
typo3/cmseq6.2.7
typo3/cmseq6.2.0
typo3/cmseq6.2.9
typo3/cmseq6.2.11

Name	Operator	Version
typo3/cms	eq	6.2.10-rc1
typo3/cms	eq	6.2.6
typo3/cms	eq	7.0.0
typo3/cms	eq	6.2.13
typo3/cms	eq	7.0.1
typo3/cms	eq	6.2.1
typo3/cms	eq	6.2.7
typo3/cms	eq	6.2.0
typo3/cms	eq	6.2.9
typo3/cms	eq	6.2.11

Rows per page:

1-10 of 211

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-07-01-1.yaml

github.com/TYPO3/typo3

github.com/TYPO3/typo3/commit/0decbf83c531cab77497429eb2edecf9a1038b25

github.com/TYPO3/typo3/commit/bff9fa5945801d1d2c641ddc8eb86c6647549d80

typo3.org/security/advisory/typo3-core-sa-2015-002

typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002

7.1 High

AI Score

Confidence

Low

JSON