CVE-2011-4614 PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7...
MediumCVSS 6.8
EPSS 5.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACK_PATH parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3 | = 4.5 | No fix listed |
| typo3 | = 4.5.1 | No fix listed |
| typo3 | = 4.5.2 | No fix listed |
| typo3 | = 4.5.3 | No fix listed |
| typo3 | = 4.5.4 | No fix listed |
| typo3 | = 4.5.5 | No fix listed |
| typo3 | = 4.5.6 | No fix listed |
| typo3 | = 4.5.7 | No fix listed |
| typo3 | = 4.5.8 | No fix listed |
| typo3 | = 4.6 | No fix listed |
| typo3 | = 4.6.1 | No fix listed |
References
- 47201 third-party-advisory vendor-advisory
- typo3.org
- typo3.org patch vendor-advisory
- [oss-security] 20111216 TYPO3 typo3-core-sa-2011-004 mailing-list
- 77776 vdb-entry