Remote Code Execution

2020-08-0306:13:19

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

typo3

remote code execution

extbase plugin

insecure verification mechanism

cryptographic mac

EPSS

0.115

Percentile

95.3%

JSON

friendsoftypo3/mediace is vulnerable to remote code execution. An attacker who has access to Extbase plugin or module action within a TYPO3 installation is able to execute arbitrary code by injecting arbitrary data with a valid cryptographic MAC. The vulnerability exists due to an insecure internal verification mechanism.