CVE-2013-7073: Infoleak
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 6.1.7 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 6.0.12 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.7.17 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.5.32
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7073?
CVE-2013-7073 is classified as a medium severity vulnerability due to the improper permission checks that allow unauthorized access to database columns.
How do I fix CVE-2013-7073?
To fix CVE-2013-7073, upgrade TYPO3 to version 6.1.7, 6.0.12, or 4.7.17 or later.
What versions of TYPO3 are affected by CVE-2013-7073?
CVE-2013-7073 affects TYPO3 versions 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6.
Can remote authenticated editors exploit CVE-2013-7073?
Yes, remote authenticated editors can exploit CVE-2013-7073 to read arbitrary TYPO3 table columns due to the lack of permission checks.
What software should I update to mitigate CVE-2013-7073?
Update TYPO3 CMS to versions 6.1.7, 6.0.12, or 4.7.17 to mitigate CVE-2013-7073.