PT-2019-12516

CVE-2019-11832

Published

2019-05-09

Updated

2022-05-24

Description by

CVSS 2.0

9.3

High

MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 8.x through 8.7.24 TYPO3 versions 9.x through 9.5.5

Description The issue allows remote code execution due to improper configuration of image processing applications, such as ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary gs must be available on the server system.

Recommendations For TYPO3 versions 8.x through 8.7.24, update to version 8.7.25 or later. For TYPO3 versions 9.x through 9.5.5, update to version 9.5.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-20: Improper Input Validation

Related identifiers

CVE-2019-11832