TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts · GHSA-4r76-xr68-w7m7 · GitHub Advisory Database · GitHub

TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts

High severity GitHub Reviewed Published May 30, 2024 to the GitHub Advisory Database • Updated May 30, 2024

Package

typo3/cms (Composer)

Affected versions

>= 6.2.0, < 6.2.14

>= 7.0.0, < 7.3.1

Patched versions

6.2.14

7.3.1

Description

It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.

References

Published to the GitHub Advisory Database May 30, 2024

Reviewed May 30, 2024

Last updated May 30, 2024

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H