GHSA-772m-43f3-hmf8
GHSA-772m-43f3-hmf8 · TYPO3 Broken Access Control in Localization Handling
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.
CVSS 6.5 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
typo3/cms Packagist
- Versions du logiciel
- 8.0.0
- 8.0.1
- 8.1.0
- 8.1.1
- 8.1.2
- 8.2.0
- 8.2.1
- 8.3.0
- 8.3.1
- 8.4.0
- 8.4.1
- 8.5.0
- 8.5.1
- 8.6.0
- 8.6.1
- 8.7.0
- 8.7.1
- 8.7.2
- v8.7.10
- v8.7.11
- v8.7.12
- v8.7.13
- v8.7.14
- v8.7.15
- v8.7.16
- v8.7.17
- v8.7.18
- v8.7.19
- v8.7.20
- v8.7.21
- v8.7.22
- v8.7.3
- v8.7.4
- v8.7.5
- v8.7.6
- v8.7.7
- v8.7.8
- v8.7.9
- Plages de versions concernées
- ECOSYSTEM: ≥ 8.0.0, < 8.7.23
Mettez à jour vers 8.7.23
Sources originales
- https://github.com/TYPO3/typo3/commit/5004201ee77a69cb825637bc95cdeedb1186f4d4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-3.yaml
- https://github.com/TYPO3/typo3
- https://typo3.org/security/advisory/typo3-core-sa-2019-003
- https://osv.dev/vulnerability/GHSA-772m-43f3-hmf8