logo

Database

Lack of data validation In typo3/cms

Description

TYPO3 Arbitrary Shell Execution in Swiftmailer library The swiftmailer library in use allows to execute arbitrary shell commands if the "From" header comes from a non-trusted source and no "Return-Path" is configured. Affected are only TYPO3 installation the configuration option

$GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport']

is set to "sendmail". Installations with the default configuration are not affected.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. GCVE-GHSA-45xg-4w5x-j429

References

1. https://github.com/TYPO3/typo3/commit/313c4bba53dd78803a9ee97c1f6f1d450a5215212. https://github.com/TYPO3/typo3/commit/6af37574e063929eaab066dd9920b1fa8815da123. https://github.com/TYPO3/typo3/commit/dbdd9f22b7cebf43f2e4abdb2a6a8a9f32af8f614. https://github.com/TYPO3/typo3/commit/ead183c5acf25b7e1121adee5a5860bd9b5f05a25. https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2014-10-22-2.yaml6. https://typo3.org/security/advisory/typo3-core-sa-2014-002

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.