Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-30451

Date: December 24, 2023

In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].

Severity Score

Related Resources (9)

https://nvd.nist.gov/vuln/detail/CVE-2023-30451
https://github.com/TYPO3/typo3/security/advisories/GHSA-w6x2-jg8h-p6mp
https://typo3.org/security/advisory/typo3-core-sa-2024-001
https://github.com/TYPO3/typo3/commit/78fb9287a2f0487c39288070cb0493a5265f1789
https://github.com/TYPO3/typo3
https://github.com/TYPO3/typo3/commit/205115cca3d67594a12d0195c937da0e51eb494a
http://packetstormsecurity.com/files/176274/TYPO3-11.5.24-Path-Traversal.html
https://github.com/TYPO3/typo3/commit/accf537c7379b4359bc0f957c4d0c07baddd710a
https://www.mend.io/vulnerability-database/CVE-2023-30451

Severity Score

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): HIGH
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us