A vulnerability has been found in the following third-party TYPO3 extension: ameos_dragndropupload
Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: Version 2.0.2 and below
Vulnerability Types: Arbitrary Code Execution
Release Date: 07.09.2011
Problem Description: Failing to properly authenticate the user, ameos_dragndropupload can be used to upload any files without beeing logged in.
Solution: Update to version 3.0.0 or higher. At the time of the publication of this advisory, the current version of the extension is 3.1.1. which is available from the TYPO3 extension manager and attypo3.org/extensions/repository/view/ameos_dragndropupload/3.1.1/.
Credits: Thanks to Oliver Hader who discovered and reported this issue.