CVE-2020-15515: Remote Code Execution in turn extension for TYPO3
Summary
CVE-2020-15515: Remote code execution in turn extension for TYPO3. Affects marcwillmann/turn versions < 0.3.3. Fixed in 0.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The turn extension is a package available on Packagist for TYPO3, a popular content management system. It provides additional functionality for TYPO3 websites. The turn extension version 0.3.2 and earlier are vulnerable to remote code execution.
Vulnerability Detail
The turn extension for TYPO3 version 0.3.2 and earlier allows remote code execution. This vulnerability can be exploited by an attacker to execute arbitrary code on the affected system. The impact of this vulnerability is high, as it allows an attacker to take complete control over the TYPO3 website and potentially access sensitive information.
How To Fix
Minimum fixed version
0.3.3
This is the first release that contains the fix.
composer require marcwillmann/turn:0.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the turn extension to the latest version.
Conclusion
The turn extension for TYPO3 version 0.3.2 and earlier is vulnerable to remote code execution. To protect your TYPO3 website, it is recommended to update the turn extension to version 0.3.3 or later. This update includes a patch that addresses the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for marcwillmann/turn →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the affected TYPO3 system, potentially leading to a complete compromise of the website and unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your TYPO3 website is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch is available in version 0.3.3 of the turn extension for TYPO3. It is recommended to update to this version to fix the vulnerability.
Yes, this vulnerability can be exploited remotely by an attacker without requiring any authentication.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory. However, it is crucial to apply the fix as soon as possible to mitigate the risk.
