CVE-2011-4904: Input Validation
Published Nov 6, 2019
·Updated
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
Affected Software
5 affected componentsFixes available
debian/typo3-src
composer/typo3/cms>=4.5.0<4.5.4
4.5.4
composer/typo3/cms<4.4.9
4.4.9
Typo3 TYPO3>=4.5.0<4.5.4
Typo3 TYPO3>=4.4.0<4.4.9
Event History
Nov 6, 2019
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
DescriptionWeakness
Apr 22, 2022
Advisory Published
via GitHub·12:24 AM
Frequently Asked Questions
1
What is CVE-2011-4904?
CVE-2011-4904 is a vulnerability in TYPO3 before version 4.4.9 and 4.5.x before version 4.5.4 that allows remote attackers to retrieve ExtDirect endpoint services without proper access control.
2
How severe is the vulnerability?
The severity of CVE-2011-4904 is medium with a CVSS score of 6.5.
3
Which software versions are affected by CVE-2011-4904?
TYPO3 versions before 4.4.9 and 4.5.x before 4.5.4 are affected by this vulnerability.
4
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2011-4904?
The Common Weakness Enumeration (CWE) ID associated with CVE-2011-4904 is CWE-20.
5
How can I fix the vulnerability in TYPO3?
To fix the vulnerability, update TYPO3 to version 4.4.9 or 4.5.4, depending on the installed version.