Remote Code Execution in TYPO3 Due to Improper Image Processing Configuration
CVE-2019-11832

7.5HIGH

Key Information:

Vendor

Typo3

Status
Typo3
Vendor
CVE Published:
9 May 2019

What is CVE-2019-11832?

TYPO3 CMS versions prior to 8.7.25 and 9.5.6 are vulnerable due to inadequate configuration of image processing applications. This security flaw can potentially be exploited to perform remote code execution, allowing an attacker to execute arbitrary commands on the server. The vulnerability stems from the mishandling of ImageMagick and GraphicsMagick, both widely used for image processing tasks within these TYPO3 versions. It is crucial for users to upgrade to the latest versions to mitigate this risk.

References

https://typo3.org/security/advisory/typo3-core-sa-2019-012/
x_refsource_MISC
http://www.securityfocus.com/bid/108305
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.