CVE-2019-19848

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security	Vendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2019-024/	Vendor Advisory
https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security	Vendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2019-024/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:typo3:typo3::::::::
	cpe:2.3:a:typo3:typo3::::::::
	cpe:2.3:a:typo3:typo3::::::::

History

21 Nov 2024, 04:35

Type	Values Removed	Values Added
References	~~() https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security - Vendor Advisory~~	() https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security - Vendor Advisory
References	~~() https://typo3.org/security/advisory/typo3-core-sa-2019-024/ - Vendor Advisory~~	() https://typo3.org/security/advisory/typo3-core-sa-2019-024/ - Vendor Advisory

Information

Published : 2019-12-17 17:15

Updated : 2024-11-21 04:35

NVD link : CVE-2019-19848

Mitre link : CVE-2019-19848

CVE.ORG link : CVE-2019-19848

JSON object : View

Products Affected

typo3

typo3

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2019-19848", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-12-17T17:15:17.787", "references": [{"url": "https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)"}, {"lang": "es", "value": "Se descubri\u00f3 un problema en TYPO3 versiones anteriores a la versi\u00f3n 8.7.30, versiones 9.x anteriores a la versi\u00f3n 9.5.12 y versiones 10.x anteriores a la versi\u00f3n 10.2.2. Se ha descubierto que la extracci\u00f3n de archivos ZIP cargados manualmente en Extension Manager es vulnerable al salto de directorio. Privilegios de administrador son requeridos para explotar esta vulnerabilidad. (En versi\u00f3n v9 LTS y posteriores, tambi\u00e9n son requeridos privilegios de Mantenedor del Sistema)."}], "lastModified": "2024-11-21T04:35:31.413", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65D7489C-BBC7-4908-83E5-2EF1564AE355", "versionEndExcluding": "8.7.30"}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "747F57A7-EB7A-49C6-AF18-DDD45AC57138", "versionEndExcluding": "9.5.12", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC015DE3-2712-4CBD-A5DE-2DD4F6BA774F", "versionEndExcluding": "10.2.2", "versionStartIncluding": "10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}