CVE-2023-30451

Published Dec 25, 2023

Last updated 10 months ago

CVSS medium 4.9

Overview

Description: In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.9
Impact score: 3.6
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:typo3:typo3:11.5.24:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "39861941-0E9B-46A9-9C88-4886FEE7C544"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References