Skip to content

Insecure Deserialization in TYPO3 CMS

High severity GitHub Reviewed Published Jun 5, 2024 to the GitHub Advisory Database • Updated Jun 5, 2024

Package

composer typo3/cms (Composer)

Affected versions

>= 8.5.0, < 8.7.17
>= 9.0.0, < 9.3.2

Patched versions

8.7.17
9.3.2

Description

It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).

References

Published to the GitHub Advisory Database Jun 5, 2024
Reviewed Jun 5, 2024
Last updated Jun 5, 2024

Severity

High

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-8h28-f46f-m87h

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.