VDB
Sign up
HIGH

GHSA-74w6-ww7w-45j9

Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection

Quick fix

GHSA-74w6-ww7w-45j9 — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^4.0.10

Details

The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms
Introduced in: 4.0.0Fixed in: 4.0.10
Fixcomposer require typo3/cms:^4.0.10
Packagist/typo3/cms
Introduced in: 4.1.0Fixed in: 4.1.8
Fixcomposer require typo3/cms:^4.1.8
Packagist/typo3/cms
Introduced in: 4.2.0Fixed in: 4.2.4
Fixcomposer require typo3/cms:^4.2.4

References