CVE-2010-3663: Malicious File Upload
First published: Mon Nov 04 2019(Updated: )
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Typo3 Typo3 | >=4.4.0<4.4.1 | |
| Typo3 Typo3 | >=4.3.0<4.3.4 | |
| Typo3 Typo3 | <4.1.14 | |
| Typo3 Typo3 | >=4.2.0<4.2.13 | |
| composer/typo3/cms-backend | >=4.4<4.4.1 | 4.4.1 |
| composer/typo3/cms-backend | >=4.3<4.3.4 | 4.3.4 |
| composer/typo3/cms-backend | >=4.2<4.2.13 | 4.2.13 |
| composer/typo3/cms-backend | <4.1.14 | 4.1.14 |
| debian/typo3-src | ||
| <4.1.14 | ||
| >=4.2.0<4.2.13 | ||
| >=4.3.0<4.3.4 | ||
| >=4.4.0<4.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2010-3663?
CVE-2010-3663 is a vulnerability in TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 that allows remote attackers to execute arbitrary code on the backend.
How severe is CVE-2010-3663?
CVE-2010-3663 has a severity score of 8.8 out of 10.
What is the affected software for CVE-2010-3663?
The affected software for CVE-2010-3663 is TYPO3 versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1.
How can I fix CVE-2010-3663?
To fix CVE-2010-3663, update TYPO3 to version 4.1.14, 4.2.13, 4.3.4, or 4.4.1.
Where can I find more information about CVE-2010-3663?
You can find more information about CVE-2010-3663 at the TYPO3 security advisory and Debian security tracker websites.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wjpc-gjf7-9938
- alias/CVE-2010-3663
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/severity
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/4.4.0
- version/typo3 typo3/4.3.0
- version/typo3 typo3/4.2.0
- package-manager/composer
- package-manager/debian