From c6e8585bd64fc8a1812b2b390baef1c4e83621db Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 14 Apr 2025 15:49:29 +0000
Subject: [PATCH] Publish Advisories

GHSA-54jj-pxx2-pv8h
GHSA-54jj-pxx2-pv8h
---
 .../GHSA-54jj-pxx2-pv8h.json                  | 81 +++++++++++++++++++
 .../GHSA-54jj-pxx2-pv8h.json                  | 31 -------
 2 files changed, 81 insertions(+), 31 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json b/advisories/github-reviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json
new file mode 100644
index 00000000000..ea4c560d985
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json
@@ -0,0 +1,81 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-54jj-pxx2-pv8h",
+  "modified": "2025-04-14T15:47:43Z",
+  "published": "2022-05-17T04:43:06Z",
+  "aliases": [
+    "CVE-2013-4250"
+  ],
+  "summary": "TYPO3 doesn't properly check file extensions",
+  "details": "The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.0.0"
+            },
+            {
+              "fixed": "6.0.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "typo3/cms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.1.0"
+            },
+            {
+              "fixed": "6.1.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4250"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/TYPO3/typo3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://typo3.org/security/advisory/typo3-core-sa-2013-002"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20",
+      "CWE-434"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-14T15:47:43Z",
+    "nvd_published_at": "2014-05-20T14:55:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json b/advisories/unreviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json
deleted file mode 100644
index bc9896ad5f0..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-54jj-pxx2-pv8h",
-  "modified": "2025-04-12T12:33:53Z",
-  "published": "2022-05-17T04:43:06Z",
-  "aliases": [
-    "CVE-2013-4250"
-  ],
-  "details": "The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4250"
-    },
-    {
-      "type": "WEB",
-      "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-002"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-20"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2014-05-20T14:55:00Z"
-  }
-}
\ No newline at end of file