CVE-2013-4321: Code Injection
First published: Tue May 20 2014(Updated: )
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TYPO3 | =6.1 | |
| TYPO3 | =6.1.1 | |
| TYPO3 | =6.1.2 | |
| TYPO3 | =6.1.3 | |
| TYPO3 | =6.0 | |
| TYPO3 | =6.0.1 | |
| TYPO3 | =6.0.2 | |
| TYPO3 | =6.0.3 | |
| TYPO3 | =6.0.4 | |
| TYPO3 | =6.0.5 | |
| TYPO3 | =6.0.6 | |
| TYPO3 | =6.0.7 | |
| composer/typo3/cms | >=6.1.0<6.1.4 | 6.1.4 |
| composer/typo3/cms | >=6.0.0<6.0.9 | 6.0.9 |
| =6.1 | ||
| =6.1.1 | ||
| =6.1.2 | ||
| =6.1.3 | ||
| =6.0 | ||
| =6.0.1 | ||
| =6.0.2 | ||
| =6.0.3 | ||
| =6.0.4 | ||
| =6.0.5 | ||
| =6.0.6 | ||
| =6.0.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-4321?
CVE-2013-4321 is considered a high severity vulnerability due to its ability to allow remote authenticated users to execute arbitrary PHP code.
How do I fix CVE-2013-4321?
To fix CVE-2013-4321, you should upgrade TYPO3 to version 6.0.8 or 6.1.4 or later.
Which versions of TYPO3 are affected by CVE-2013-4321?
CVE-2013-4321 affects TYPO3 versions 6.0.x prior to 6.0.8 and 6.1.x prior to 6.1.4.
What type of users are impacted by CVE-2013-4321?
CVE-2013-4321 impacts remote authenticated editors who are able to rename files.
What is the main issue caused by CVE-2013-4321?
The main issue caused by CVE-2013-4321 is the execution of arbitrary PHP code through the file renaming process.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-m76j-69c2-c3m8
- alias/CVE-2013-4321
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/description
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/source
- agent/tags
- collector/nvd-api
- vendor/typo3
- canonical/typo3
- version/typo3/6.1
- version/typo3/6.1.1
- version/typo3/6.1.2
- version/typo3/6.1.3
- version/typo3/6.0
- version/typo3/6.0.1
- version/typo3/6.0.2
- version/typo3/6.0.3
- version/typo3/6.0.4
- version/typo3/6.0.5
- version/typo3/6.0.6
- version/typo3/6.0.7
- package-manager/composer