Multiple vulnerabilities in TYPO3

1) Cross-site scripting

EUVDB-ID: #VU42136

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-7078

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled,. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

TYPO3: 4.5 - 6.1.6

CPE2.3

External links

http://osvdb.org/100885
http://seclists.org/oss-sec/2013/q4/473
http://seclists.org/oss-sec/2013/q4/487
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004
http://www.securityfocus.com/bid/64239
http://exchange.xforce.ibmcloud.com/vulnerabilities/89629

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU42210

Risk: Low

CVSSv3.1: 1.3 [CVSS:3.1/AV:N/AC:L/PR:/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-7073

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.

Mitigation

Install update from vendor's website.

Vulnerable software versions

TYPO3: 4.5.0 - 6.1.6

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
http://seclists.org/oss-sec/2013/q4/473
http://seclists.org/oss-sec/2013/q4/487
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/
http://www.debian.org/security/2014/dsa-2834

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cryptographic issues

EUVDB-ID: #VU42211

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:N/AC:L/PR:/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-7075

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote #AU# to read and manipulate data.

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."

Mitigation

Install update from vendor's website.

Vulnerable software versions

TYPO3: 4.5.0 - 6.1.6

CPE2.3

External links

http://seclists.org/oss-sec/2013/q4/473
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/
http://www.debian.org/security/2014/dsa-2834

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU42212

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-7079

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

TYPO3: 4.5.0 - 6.1.6

CPE2.3

External links

http://seclists.org/oss-sec/2013/q4/473
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/
http://www.debian.org/security/2014/dsa-2834
http://www.securityfocus.com/bid/64252

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU42214

Risk: Low

CVSSv3.1: 2.3 [CVSS:3.1/AV:N/AC:L/PR:/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-7081

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote #AU# to read and manipulate data.

The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

TYPO3: 4.5.0 - 6.1.6

CPE2.3

External links

http://seclists.org/oss-sec/2013/q4/473
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004/
http://www.debian.org/security/2014/dsa-2834

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cross-site scripting

EUVDB-ID: #VU42222

Risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2013-7077

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

TYPO3: 6.0 - 6.1.6

CPE2.3

cpe:2.3:a:typo3:typo3:6.1.6:*:*:*:*:*:*:*

External links

http://osvdb.org/100884
http://seclists.org/oss-sec/2013/q4/473
http://seclists.org/oss-sec/2013/q4/487
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004
http://exchange.xforce.ibmcloud.com/vulnerabilities/89626

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2013-7078 CVE-2013-7073 CVE-2013-7075 CVE-2013-7079 CVE-2013-7081 CVE-2013-7077
CWE-ID	CWE-79 CWE-264 CWE-310 CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	TYPO3 Web applications / CMS
Vendor	TYPO3