CVE-2013-7073
CVE-2013-7073
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
CVSS 6.5 · Medium · EPSS 1.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
typo3/cms Packagist
- Affected ranges
- ECOSYSTEM: ≥ 4.5.0, < 4.5.32
Update to 4.5.32
typo3/cms Packagist
- Affected ranges
- ECOSYSTEM: ≥ 4.7.0, < 4.7.17
Update to 4.7.17
typo3/cms Packagist
- Affected ranges
- ECOSYSTEM: ≥ 6.0.0, < 6.0.12
Update to 6.0.12
typo3/cms Packagist
- Affected ranges
- ECOSYSTEM: ≥ 6.1.0, < 6.1.7
Update to 6.1.7
Original sources
- http://seclists.org/oss-sec/2013/q4/487
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html
- http://seclists.org/oss-sec/2013/q4/473
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html
- http://www.debian.org/security/2014/dsa-2834
- https://nvd.nist.gov/vuln/detail/CVE-2013-7073