CVE-2019-12747: High severity typo3 vulnerability
Published Jun 25, 2019
·Updated
Insecure Deserialization in TYPO3 CMS
Other sources
TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
Affected Software
8 affected componentsFixes available
composer/typo3/cms>=8.0.0, <8.7.27, >=9.0.0, <9.5.8
composer/typo3/cms-core>=8.0.0, <8.7.27, >=9.0.0, <9.5.8
composer/typo3/cms>=9.0.0<9.5.8
9.5.8
composer/typo3/cms>=8.0.0<8.7.27
8.7.27
composer/typo3/cms-core>=9.0.0<9.5.8
9.5.8
composer/typo3/cms-core>=8.0.0<8.7.27
8.7.27
Typo3 TYPO3>=8.3.0<=8.7.26
Typo3 TYPO3>=9.0.0<=9.5.7
Event History
Jun 25, 2019
Advisory Published
06:40 AM
Jul 9, 2019
CVE Published
via MITRE·02:13 PM
Data Sourced
via MITRE·02:13 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-12747?
The severity of CVE-2019-12747 is classified as a high severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2019-12747?
To fix CVE-2019-12747, update TYPO3 CMS to version 8.7.27 or 9.5.8.
3
What versions of TYPO3 are affected by CVE-2019-12747?
CVE-2019-12747 affects TYPO3 versions 8.x prior to 8.7.27 and 9.x prior to 9.5.8.
4
What does CVE-2019-12747 exploit?
CVE-2019-12747 exploits insecure deserialization of untrusted data in TYPO3 CMS.
5
Is my installation safe from CVE-2019-12747 if it is updated?
Yes, if your TYPO3 installation is updated to versions 8.7.27 or 9.5.8, it is no longer vulnerable to CVE-2019-12747.