Vigil@nce: TYPO3, four vulnerabilities
April 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use four vulnerabilities of TYPO3, in order to
obtain information, or to create a Cross Site Scripting.
– Severity: 2/4
– Creation date: 28/03/2012
IMPACTED PRODUCTS
– Debian Linux
– TYPO3
DESCRIPTION OF THE VULNERABILITY
Four vulnerabilities were announced in TYPO3.
An attacker can unserialize objects. [severity:2/4; CVE-2012-1605]
An attacker can generate a Cross Site Scripting via link contents.
[severity:2/4; CVE-2012-1606]
An attacker can obtain the database name by directly calling
Command Line Interface scripts. [severity:1/4; CVE-2012-1607]
The t3lib_div::RemoveXSS() function does not filter non printable
characters, so an attacker can still generate a Cross Site
Scripting. [severity:2/4; CVE-2012-1608]
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/TYPO3-four-vulnerabilities-11497