CVE-2010-5099: Input Validation
The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-5099?
CVE-2010-5099 has a medium severity rating as it allows unauthorized access to arbitrary PHP files.
How do I fix CVE-2010-5099?
To fix CVE-2010-5099, upgrade TYPO3 to version 4.2.16, 4.3.9, or 4.4.5 or later.
What software versions are affected by CVE-2010-5099?
CVE-2010-5099 affects TYPO3 versions 4.2.x up to 4.2.15, 4.3.x up to 4.3.8, and 4.4.x up to 4.4.4.
Can CVE-2010-5099 be exploited remotely?
Yes, CVE-2010-5099 can be exploited remotely, allowing attackers to bypass access restrictions.
What does CVE-2010-5099 allow attackers to do?
CVE-2010-5099 allows attackers to access arbitrary PHP files by bypassing the fileDenyPattern functionality in TYPO3.