{"id":"GHSA-74w6-ww7w-45j9","aliases":["CVE-2009-0258"],"title":"Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.","severity":"high","score":null,"published":"2022-05-02T03:13:52.000Z","modified":"2024-01-23T18:26:33.754Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-74w6-ww7w-45j9","url":"https://osv.dev/vulnerability/GHSA-74w6-ww7w-45j9"}],"ranges":[{"events":[{"introduced":"4.0.0"},{"fixed":"4.0.10"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.0.10"]},{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-74w6-ww7w-45j9","url":"https://osv.dev/vulnerability/GHSA-74w6-ww7w-45j9"}],"ranges":[{"events":[{"introduced":"4.1.0"},{"fixed":"4.1.8"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.1.8"]},{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-74w6-ww7w-45j9","url":"https://osv.dev/vulnerability/GHSA-74w6-ww7w-45j9"}],"ranges":[{"events":[{"introduced":"4.2.0"},{"fixed":"4.2.4"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.2.4"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2009-0258","https://exchange.xforce.ibmcloud.com/vulnerabilities/48138","https://web.archive.org/web/20111210005350/http://www.securityfocus.com/bid/33376","http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001","http://www.debian.org/security/2009/dsa-1711","http://www.openwall.com/lists/oss-security/2009/01/23/4"],"sources":[{"name":"OSV","id":"GHSA-74w6-ww7w-45j9","modified":"2024-01-23T18:26:33.754576Z","url":"https://osv.dev/vulnerability/GHSA-74w6-ww7w-45j9"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:30:33.731Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}