Description

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

Remediation

References

CVE-2010-3663

Related Vulnerabilities

OpenSSL Cryptographic Issues Vulnerability (CVE-2010-0742)

WordPress Plugin WP YouTube Live Cross-Site Scripting (1.8.2)

TYPO3 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2010-5101)

Claroline Other Vulnerability (CVE-2006-1594)

WordPress Plugin Formidable-Clockwork SMS Cross-Site Scripting (1.0.3)

Severity

High

Classification

CVE-2010-3663 CWE-434 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities