CVE-2012-1605: Medium severity typo3 vulnerability
Published Sep 4, 2012
·Updated
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
Affected Software
13 affected componentsFixes available
composer/typo3/cms>=4.5.0<4.5.14
4.5.14
composer/typo3/cms>=4.4.0<4.4.14
4.4.14
composer/typo3/cms>=4.6<=4.6.6
4.6.7
Typo3 TYPO3=4.6
Typo3 TYPO3=4.6.0
Typo3 TYPO3=4.6.1
Typo3 TYPO3=4.6.2
Typo3 TYPO3=4.6.3
Typo3 TYPO3=4.6.4
Typo3 TYPO3=4.6.5
Typo3 TYPO3=4.6.6
Typo3 TYPO3=4.7
Typo3 TYPO3=6.0
Event History
Sep 4, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 17, 2022
Advisory Published
05:23 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-1605?
CVE-2012-1605 is considered a critical vulnerability due to its potential for allowing remote code execution.
2
How do I fix CVE-2012-1605?
To mitigate CVE-2012-1605, upgrade TYPO3 to version 4.6.7, 4.7, or 6.0.
3
What versions of TYPO3 are affected by CVE-2012-1605?
CVE-2012-1605 affects TYPO3 versions 4.6.x through 4.6.6, 4.7, and 6.0.
4
What type of vulnerability is CVE-2012-1605?
CVE-2012-1605 is an unserialization vulnerability that allows attackers to execute arbitrary code.
5
Can CVE-2012-1605 be exploited remotely?
Yes, CVE-2012-1605 can be exploited by remote attackers through untrusted data.