Remote Code Execution (RCE)

2020-07-3004:30:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

rce

typo3/cms

mediace extension

insecure cryptography

arbitrary checksums

injection of arbitrary data

extbase plugin

module action

remote code execution

EPSS

0.115

Percentile

95.3%

JSON

typo3/cms is vulnerable to insecure cryptography. During installation with mediace extension, the vulnerability exists because it was possible to generate arbitrary checksums that allows the injection of arbitrary data, allowing an attacker with at least one Extbase plugin or module action to trigger remote code execution.