{"id":"GHSA-f35p-hcwf-9f9f","aliases":["CVE-2008-2717"],"title":"TYPO3 Unrestricted File Upload vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.","severity":"medium","score":null,"published":"2022-05-01T23:52:38.000Z","modified":"2024-02-09T16:56:40.618Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms-core","sources":[{"name":"OSV · GHSA-f35p-hcwf-9f9f","url":"https://osv.dev/vulnerability/GHSA-f35p-hcwf-9f9f"}],"ranges":[{"events":[{"introduced":"4.0.0"},{"fixed":"4.0.9"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.0.9"]},{"ecosystem":"Packagist","name":"typo3/cms-core","sources":[{"name":"OSV · GHSA-f35p-hcwf-9f9f","url":"https://osv.dev/vulnerability/GHSA-f35p-hcwf-9f9f"}],"ranges":[{"events":[{"introduced":"4.1.0"},{"fixed":"4.1.7"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.1.7"]},{"ecosystem":"Packagist","name":"typo3/cms-core","sources":[{"name":"OSV · GHSA-f35p-hcwf-9f9f","url":"https://osv.dev/vulnerability/GHSA-f35p-hcwf-9f9f"}],"ranges":[{"events":[{"introduced":"4.2.0"},{"fixed":"4.2.1"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.2.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2008-2717","https://exchange.xforce.ibmcloud.com/vulnerabilities/42988","https://github.com/TYPO3-CMS/core","https://web.archive.org/web/20080815050856/http://securityreason.com/securityalert/3945","https://web.archive.org/web/20081201212626/http://secunia.com/advisories/30619","https://web.archive.org/web/20081206030529/http://secunia.com/advisories/30660","https://web.archive.org/web/20200228131005/http://www.securityfocus.com/bid/29657","https://web.archive.org/web/20201208012148/http://www.securityfocus.com/archive/1/493270/100/0/threaded","http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern","http://typo3.org/teams/security/security-bulletins/typo3-20080611-1","http://www.debian.org/security/2008/dsa-1596"],"sources":[{"name":"OSV","id":"GHSA-f35p-hcwf-9f9f","modified":"2024-02-09T16:56:40.618073Z","url":"https://osv.dev/vulnerability/GHSA-f35p-hcwf-9f9f"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:50:31.598Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}