Publish Advisories

GHSA-54jj-pxx2-pv8h GHSA-54jj-pxx2-pv8h
2026-05-22 18:04:22 -07:00 · 2025-04-14 15:49:29 +00:00
parent 10737a9572
commit c6e8585bd6
2 changed files with 81 additions and 31 deletions
@@ -0,0 +1,81 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-54jj-pxx2-pv8h",
+  "modified": "2025-04-14T15:47:43Z",
+  "published": "2022-05-17T04:43:06Z",
+  "aliases": [
+    "CVE-2013-4250"
+  ],
+  "summary": "TYPO3 doesn't properly check file extensions",
+  "details": "The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.0.0"
+            },
+            {
+              "fixed": "6.0.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.1.0"
+            },
+            {
+              "fixed": "6.1.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4250"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/TYPO3/typo3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://typo3.org/security/advisory/typo3-core-sa-2013-002"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20",
+      "CWE-434"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-14T15:47:43Z",
+    "nvd_published_at": "2014-05-20T14:55:00Z"
+  }
+}
@@ -1,31 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-54jj-pxx2-pv8h",
-  "modified": "2025-04-12T12:33:53Z",
-  "published": "2022-05-17T04:43:06Z",
-  "aliases": [
-    "CVE-2013-4250"
-  ],
-  "details": "The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4250"
-    },
-    {
-      "type": "WEB",
-      "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-002"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-20"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2014-05-20T14:55:00Z"
-  }
-}