CVE-2010-3663: TYPO3 Arbitrary Code Execution vulnerability on the backend
TYPO3 Arbitrary Code Execution vulnerability on the backend
Other sources
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.4.1 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.3.4 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.2.13 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.1.14
Event History
Frequently Asked Questions
What is CVE-2010-3663?
CVE-2010-3663 is a vulnerability in TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 that allows remote attackers to execute arbitrary code on the backend.
How severe is CVE-2010-3663?
CVE-2010-3663 has a severity score of 8.8 out of 10.
What is the affected software for CVE-2010-3663?
The affected software for CVE-2010-3663 is TYPO3 versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1.
How can I fix CVE-2010-3663?
To fix CVE-2010-3663, update TYPO3 to version 4.1.14, 4.2.13, 4.3.4, or 4.4.1.
Where can I find more information about CVE-2010-3663?
You can find more information about CVE-2010-3663 at the TYPO3 security advisory and Debian security tracker websites.