GHSA-4r76-xr68-w7m7high8.8No CVE assigned
TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
Impact
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
typo3/cms Packagist
| Affected range | Recorded fix |
|---|---|
| From 6.2.0 before 6.2.14Ecosystem versions | 6.2.14 |
| From 7.0.0 before 7.3.1Ecosystem versions | 7.3.1 |
Version evidence: OSV · GHSA-4r76-xr68-w7m7
View original version evidence (21 explicit versions)
Original source description
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
References
- Patch github.com/TYPO3/typo3/commit/0decbf83c531cab77497429eb2edecf9a1038b25
- Patch github.com/TYPO3/typo3/commit/bff9fa5945801d1d2c641ddc8eb86c6647549d80
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-07-01-1.yaml
- Source reference github.com/TYPO3/typo3
- Security advisory typo3.org/security/advisory/typo3-core-sa-2015-002
- Security advisory typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002