CVE-2012-3527

EUVD-2012-3482
view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.6 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
Affected Products (NVD)
VendorProductVersion
typo3typo3
4.5.0 ≤
𝑥
< 4.5.19
typo3typo3
4.6.0 ≤
𝑥
< 4.6.12
typo3typo3
4.7.0 ≤
𝑥
< 4.7.4
debiandebian_linux
6.0
debiandebian_linux
7.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
typo3-src
hardy
ignored
lucid
ignored
natty
ignored
oneiric
ignored
precise
ignored
quantal
not-affected
raring
not-affected
saucy
not-affected
trusty
dne
utopic
not-affected
vivid
not-affected
wily
dne
xenial
dne
yakkety
dne
zesty
dne
Common Weakness Enumeration
References
http://osvdb.org/84773
http://secunia.com/advisories/50287
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/
http://www.debian.org/security/2012/dsa-2537
http://www.openwall.com/lists/oss-security/2012/08/22/8
https://exchange.xforce.ibmcloud.com/vulnerabilities/77791
http://osvdb.org/84773
http://secunia.com/advisories/50287
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/
http://www.debian.org/security/2012/dsa-2537
http://www.openwall.com/lists/oss-security/2012/08/22/8
https://exchange.xforce.ibmcloud.com/vulnerabilities/77791