Actu
Vigil@nce - TYPO3 Page path: privilege escalation via unserialization
September 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can make TYPO3 Page path unserialize specially crafted
data, likely in order to escalate his privileges.
Impacted products: TYPO3 Extensions not comprehensive.
Severity: 2/4.
Creation date: 07/07/2016.
DESCRIPTION OF THE VULNERABILITY
The Page path extension can be installed on TYPO3.
It may load data and notably strings from an external source.
However, the module accepts untrusted source as a valid provider.
What is this data and so why they must be trusted is not known.
An attacker can therefore make TYPO3 Page path unserialize
specially crafted data, likely in order to escalate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/TYPO3-Page-path-privilege-escalation-via-unserialization-20045
