From c1125ad45eece1fb028ece22e8400d0893d605a6 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 14 Apr 2025 16:02:11 +0000 Subject: [PATCH] Publish Advisories GHSA-55g3-fjwm-w2c8 GHSA-m76j-69c2-c3m8 GHSA-55g3-fjwm-w2c8 GHSA-m76j-69c2-c3m8 --- .../GHSA-55g3-fjwm-w2c8.json | 130 ++++++++++++++++++ .../GHSA-m76j-69c2-c3m8.json | 80 +++++++++++ .../GHSA-55g3-fjwm-w2c8.json | 43 ------ .../GHSA-m76j-69c2-c3m8.json | 31 ----- 4 files changed, 210 insertions(+), 74 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json diff --git a/advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json b/advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json new file mode 100644 index 00000000000..17ae9af2dd7 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-55g3-fjwm-w2c8", + "modified": "2025-04-14T16:01:20Z", + "published": "2022-05-14T04:01:57Z", + "aliases": [ + "CVE-2014-3942" + ], + "summary": "TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code", + "details": "The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.5.0" + }, + { + "fixed": "4.5.34" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.7.0" + }, + { + "fixed": "4.7.19" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.0.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3942" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://typo3.org/security/advisory/typo3-core-sa-2014-001" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html" + }, + { + "type": "WEB", + "url": "http://www.debian.org/security/2014/dsa-2942" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2014/06/03/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-14T16:01:20Z", + "nvd_published_at": "2014-06-03T14:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json b/advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json new file mode 100644 index 00000000000..4712d9311d6 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m76j-69c2-c3m8", + "modified": "2025-04-14T16:00:18Z", + "published": "2022-05-17T04:43:27Z", + "aliases": [ + "CVE-2013-4321" + ], + "summary": "TYPO3 vulnerable to remote authenticated arbitrary code execution", + "details": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.0.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4321" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://typo3.org/security/advisory/typo3-core-sa-2013-003" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-14T16:00:18Z", + "nvd_published_at": "2014-05-20T14:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json b/advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json deleted file mode 100644 index d659f072a29..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-55g3-fjwm-w2c8", - "modified": "2025-04-12T12:34:25Z", - "published": "2022-05-14T04:01:57Z", - "aliases": [ - "CVE-2014-3942" - ], - "details": "The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3942" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001" - }, - { - "type": "WEB", - "url": "http://www.debian.org/security/2014/dsa-2942" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2014/06/03/2" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-06-03T14:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json b/advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json deleted file mode 100644 index 29f32acc2ae..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-m76j-69c2-c3m8", - "modified": "2025-04-12T12:33:54Z", - "published": "2022-05-17T04:43:27Z", - "aliases": [ - "CVE-2013-4321" - ], - "details": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4321" - }, - { - "type": "WEB", - "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-05-20T14:55:00Z" - } -} \ No newline at end of file