p PatchFirst

GHSA-96jg-pmc4-cx39

GHSA-96jg-pmc4-cx39 · TYPO3 CMS Insecure Deserialization

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It has been discovered that the Form Framework (system extension `form`) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package `yaml`, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting `yaml.decode_php` enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).

CVSS 7.5 · High · Fix available

Published
Updated

Stack: php

Affected products and versions

  • typo3/cms-core Packagist

    Versions
    • v8.7.10
    • v8.7.11
    • v8.7.12
    • v8.7.13
    • v8.7.14
    • v8.7.15
    • v8.7.16
    • v8.7.7
    • v8.7.8
    • v8.7.9
    Affected ranges
    • ECOSYSTEM: ≥ 8.5.0, < 8.7.17

    Update to 8.7.17

  • typo3/cms-core Packagist

    Versions
    • v9.0.0
    • v9.1.0
    • v9.2.0
    • v9.2.1
    • v9.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 9.0.0, < 9.3.1

    Update to 9.3.1

Original sources

Check your server →