CVE-2008-2717
CVE-2008-2717
This page contains facts from public vulnerability sources. Check the original advisory before updating.
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
EPSS 3.0% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
typo3/cms-core Packagist
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.0.9
Update to 4.0.9
typo3/cms-core Packagist
- Affected ranges
- ECOSYSTEM: ≥ 4.1.0, < 4.1.7
Update to 4.1.7
typo3/cms-core Packagist
- Affected ranges
- ECOSYSTEM: ≥ 4.2.0, < 4.2.1
Update to 4.2.1
Original sources
- http://www.securityfocus.com/bid/29657
- http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/
- http://secunia.com/advisories/30619
- http://www.securityfocus.com/archive/1/493270/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42988
- http://www.debian.org/security/2008/dsa-1596
- http://www.vupen.com/english/advisories/2008/1802
- http://secunia.com/advisories/30660
- http://typo3.org/teams/security/security-bulletins/typo3-20080611-1/
- http://securityreason.com/securityalert/3945
- https://nvd.nist.gov/vuln/detail/CVE-2008-2717