CVE-2010-3663: Malicious File Upload

Q: What is CVE-2010-3663?

CVE-2010-3663 is a vulnerability in TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 that allows remote attackers to execute arbitrary code on the backend.

Q: How severe is CVE-2010-3663?

CVE-2010-3663 has a severity score of 8.8 out of 10.

Q: What is the affected software for CVE-2010-3663?

The affected software for CVE-2010-3663 is TYPO3 versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1.

Q: How can I fix CVE-2010-3663?

To fix CVE-2010-3663, update TYPO3 to version 4.1.14, 4.2.13, 4.3.4, or 4.4.1.

Q: Where can I find more information about CVE-2010-3663?

You can find more information about CVE-2010-3663 at the TYPO3 security advisory and Debian security tracker websites.

Published Nov 4, 2019

Updated

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

Affected Software

9 affected componentsFixes available

composer/typo3/cms-backend>=4.4<4.4.1

4.4.1

composer/typo3/cms-backend>=4.3<4.3.4

4.3.4

composer/typo3/cms-backend>=4.2<4.2.13

4.2.13

composer/typo3/cms-backend<4.1.14

4.1.14

debian/typo3-src

Typo3 TYPO3>=4.4.0<4.4.1

Typo3 TYPO3>=4.3.0<4.3.4

Typo3 TYPO3<4.1.14

Typo3 TYPO3>=4.2.0<4.2.13

Event History

Nov 4, 2019

CVE Published

via MITRE·09:18 PM

Data Sourced

via MITRE·09:18 PM

Description

Apr 21, 2022

Advisory Published

via GitHub·01:57 AM

Frequently Asked Questions

What is CVE-2010-3663?

CVE-2010-3663 is a vulnerability in TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 that allows remote attackers to execute arbitrary code on the backend.

How severe is CVE-2010-3663?

CVE-2010-3663 has a severity score of 8.8 out of 10.

What is the affected software for CVE-2010-3663?