PT-2021-23870
CVE-2021-43562
·
تاريخ النشر
2021-11-10
·
تاريخ التحديث
2021-11-16
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
pixxio extension for TYPO3 versions prior to 1.0.6
Description
An issue in the pixxio extension for TYPO3 allows an attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability. This occurs because the extension fails to restrict image downloads to the configured pixx.io DAM URL. As a result, an attacker can download content from a remote location and save it to a user-controlled filename, potentially leading to Remote Code Execution. Exploitation requires a TYPO3 backend user account.
Recommendations
For versions prior to 1.0.6, update to version 1.0.6 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾