Insecure file upload In typo3/cms-backend
Description
TYPO3 Arbitrary Code Execution vulnerability on the backend TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.