CVE-2011-4902: Typo3 Arbitrary File Delete
Summary
CVE-2011-4902: Typo3 Arbitrary File Delete. Affects typo3/cms across 3 version ranges.
< 4.3.12
>= 4.4.0, < 4.4.9
>= 4.5.0, < 4.5.4
Fixed in 4.3.12, 4.4.9 or 4.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Typo3 is a popular content management system (CMS) used for building and managing websites. It provides a wide range of features and functionalities for creating dynamic web applications. However, versions before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 are vulnerable to an arbitrary file delete issue. This vulnerability allows remote attackers to delete arbitrary files on the webserver, potentially leading to data loss or unauthorized access.
Vulnerability Detail
The vulnerability in Typo3 allows attackers to exploit a flaw in the software's file deletion mechanism. By sending specially crafted requests, an attacker can trick the application into deleting files that they should not have access to. This can be used to delete critical system files, configuration files, or user-uploaded content. The impact of this vulnerability depends on the files that are deleted and the privileges of the user running the webserver. It is important to note that this vulnerability requires remote access to the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.124.3.12composer require typo3/cms:4.3.12 -
>= 4.4.0, < 4.4.94.4.9composer require typo3/cms:4.4.9 -
>= 4.5.0, < 4.5.44.5.4composer require typo3/cms:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Typo3.
Conclusion
The vulnerability in Typo3 that allows arbitrary file deletion can have severe consequences, including data loss and unauthorized access. It is crucial to upgrade to the latest version of Typo3 (4.3.12, 4.4.9, or 4.5.4) to mitigate this vulnerability. Regularly updating the CMS is also recommended to ensure the application is protected against known security issues. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
Typo3 is a popular content management system (CMS) used for building and managing websites. It provides a wide range of features and functionalities for creating dynamic web applications.
The vulnerability allows remote attackers to delete arbitrary files on the webserver, potentially leading to data loss or unauthorized access.
Versions before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest version of Typo3 (4.3.12, 4.4.9, or 4.5.4).
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of Typo3.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
