Server-side request forgery in extension "Kitodo.Presentation" (dlf)

2022-02-1500:00:00

TYPO3 Association

typo3.org

0.002 Low

EPSS

Percentile

52.5%

JSON

A missing access check in an eID script of the extension allows an unauthenticated user to submit arbitrary URLs to this component. This results in Server-side request forgery allowing users to view the content of any file or webpage the webserver has access to.

CPENameOperatorVersion
dlfle2.3.1
dlfge3.3.0
dlfle3.3.3
dlfge3.0.0
dlfle3.2.2

Name	Operator	Version
dlf	le	2.3.1
dlf	ge	3.3.0
dlf	le	3.3.3
dlf	ge	3.0.0
dlf	le	3.2.2

0.002 Low

EPSS

Percentile

52.5%

JSON

Related for TYPO3-EXT-SA-2022-001