Torben Hansen

An extension allows an editor-configurable email subject string to be passed directly into a Fluid template source without restriction. An authenticated backend user with edit access to the event registration plugin or backend module can inject Fluid ViewHelper syntax into this field. This can lead to the disclosure of sensitive data or the execution of TypoScript content objects.

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a `demand-override` parameter to view hidden or time-restricted events, provided that the `disableOverrideDemand` plugin setting is not active.

The extension fails to safely process untrusted client input from an attacker-controlled cookie passed directly to the PHP `unserialize()` function. This allows a remote, unauthenticated attacker to provide a crafted serialized payload to trigger PHP Object Injection, which can lead to Remote Code Execution on the TYPO3 server. PHP Object Injection is a vulnerability that occurs when untrusted input is used to instantiate objects, potentially allowing the attacker to manipulate the application logic.

Backend users can move records to a different page even if they lack the necessary edit permissions on the source page.

Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) through the Media Module. Because the fallback storage resolves paths relative to the server's document root, this can lead to the exposure of sensitive files, such as log files.

The extension passes an attacker-controlled cookie directly to the `unserialize()` function without safe processing. A remote, unauthenticated attacker can provide a crafted serialized payload to trigger PHP Object Injection, which allows for Remote Code Execution on the TYPO3 server. This issue occurs when the content element is configured with "Persistent Mode: Static" in the plugin settings. Over 294,700 TYPO3 CMS surfaces were indexed by FOFA in the past year.

An issue was discovered in the powermail extension for TYPO3, where it fails to validate the `mail` parameter of the `createAction`, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension.

An issue in the events2 extension for TYPO3 involves missing access checks in the management plugin, leading to an insecure direct object reference (IDOR) vulnerability. This vulnerability allows unauthenticated users to potentially activate or delete various events.

The issue arises from failing to properly encode user-controlled values in file entities, making the `ShowImageController` (` eID tx cms showpic `) vulnerable to cross-site scripting. Exploiting this requires a valid backend user account with access to file entities.

The `ShowImageController` (` eID tx cms showpic `) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter, for example, `/index.php?eID=tx cms showpic?file=3&...&frame=12345`. This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side.

The issue allows XSS via indexed data.

The issue allows SQL Injection.

An issue in the femanager extension for TYPO3 is related to missing access checks in the `InvitationController`. This allows an unauthenticated user to set the password of all frontend users. The exploitation of this issue may enable a remote attacker to set an arbitrary password for system users.

The issue is related to missing access checks in the `InvitationController` function, allowing an unauthenticated user to delete all frontend users. This can be exploited by a remote attacker to delete arbitrary users.

An issue was discovered in the fe change pwd extension for TYPO3, where the extension fails to revoke existing sessions for the current user when the password has been changed.

The issue concerns the password recovery functionality in TYPO3, an open source PHP based web content management system. When users reset their password, existing sessions for that particular user account were not revoked, affecting both frontend and backend user sessions.

The issue concerns Improper Authentication in TYPO3, an open source PHP based web content management system. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account, however, credentials must be known to the adversary.

A SQL injection issue was discovered in the lux extension for TYPO3.

The issue allows SQL Injection. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows for XSS.