GHSA-9rx9-7fmh-gj3g
GHSA-9rx9-7fmh-gj3g · TYPO3 Broken Access Control in Localization Handling
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.
CVSS 6.5 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
typo3/cms-core Packagist
- Versions du logiciel
- v8.7.10
- v8.7.11
- v8.7.12
- v8.7.13
- v8.7.14
- v8.7.15
- v8.7.16
- v8.7.17
- v8.7.18
- v8.7.19
- v8.7.20
- v8.7.21
- v8.7.22
- v8.7.7
- v8.7.8
- v8.7.9
- Plages de versions concernées
- ECOSYSTEM: ≥ 8.0.0, < 8.7.23
Mettez à jour vers 8.7.23
Sources originales
- https://github.com/TYPO3-CMS/core/commit/64b1b5dc2f7cacb2ba39b74081f4179d6393b2bf
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-01-22-3.yaml
- https://github.com/TYPO3-CMS/core
- https://typo3.org/security/advisory/typo3-core-sa-2019-003
- https://osv.dev/vulnerability/GHSA-9rx9-7fmh-gj3g