Lucene search

Veracode Vulnerability DatabaseVERACODE:45477

HistoryFeb 14, 2024 - 7:01 a.m.

Code Injection

2024-02-1407:01:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

code injection

typo3

cms-core

install tool

vulnerability

improper validation

system binaries

administrator-level user

backend user

system maintainer permissions

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

typo3/cms-core is vulnerable to Code Injection. The vulnerability is due to improper validation of settings within the Install Tool when configuring the path to system binaries. This vulnerability is only exploitable by an administrator-level backend user with system maintainer permissions.