CVE-2010-1153: TYPO3 CMS Remote File Inclusion Vulnerability
Summary
CVE-2010-1153: TYPO3 PHP remote file inclusion vulnerability. Affects typo3/cms versions >= 4.3.0, < 4.3.3. Fixed in 4.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system (CMS) written in PHP, widely used for building and managing websites. It offers a robust framework for developers and users, featuring extensibility through plugins and a user-friendly interface. However, TYPO3 versions 4.3.x prior to 4.3.3 are susceptible to a PHP remote file inclusion vulnerability that can lead to severe security breaches.
Vulnerability Detail
The vulnerability arises from improper handling of the className variable in the autoloader of TYPO3. This flaw allows remote attackers to include arbitrary PHP files from a URL, potentially leading to the execution of malicious code on the server. The implications of this vulnerability are significant, as it can compromise the integrity of the web application, allowing attackers to manipulate data, gain unauthorized access, or even take control of the server.
How To Fix
Minimum fixed version
4.3.3
This is the first release that contains the fix.
composer require typo3/cms:4.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the autoloader or restricting access to the input fields associated with the className variable. However, these are temporary measures and do not replace the need for a proper update.
Conclusion
The TYPO3 PHP remote file inclusion vulnerability (CVE-2010-1153) poses a serious risk to users of versions 4.3.x prior to 4.3.3. It is crucial to update to the latest version to safeguard your application against potential attacks. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for typo3/cms →
FAQ
It is a PHP remote file inclusion vulnerability that allows attackers to execute arbitrary PHP code.
TYPO3 versions 4.3.x before 4.3.3 are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and complete control over the server.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
