CVE-2012-3527

Severity Score

4.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."

view_help.php en el sistema de ayuda backend de TYPO3 v4.5.x anterior a v4.5.19, v4.6.x anterior a v4.6.12 y v4.7.x anterior a v4.7.4 permite a usuarios remotos autenticados tomar una variable de objetos arbitrarios y posiblemente ejecutar código PHP arbitrario a través de un parámetro no especifico, en relación con una "missing signature (HMAC)."

*Credits: N/A

CVSS Scores

NISTv2 4.6

Attack Vector

Network

Attack Complexity

High

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-06-14 CVE Reserved
2012-08-30 CVE Published
2024-01-21 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-502: Deserialization of Untrusted Data

CAPEC

References (6)

URL	Tag	Source
http://osvdb.org/84773	Broken Link
http://secunia.com/advisories/50287	Not Applicable
http://www.openwall.com/lists/oss-security/2012/08/22/8	Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/77791	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004	2024-01-21
http://www.debian.org/security/2012/dsa-2537	2024-01-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 4.5.0 < 4.5.19 Search vendor "Typo3" for product "Typo3" and version " >= 4.5.0 < 4.5.19"		-		Affected
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 4.6.0 < 4.6.12 Search vendor "Typo3" for product "Typo3" and version " >= 4.6.0 < 4.6.12"		-		Affected
Typo3 Search vendor "Typo3"		Typo3 Search vendor "Typo3" for product "Typo3"				>= 4.7.0 < 4.7.4 Search vendor "Typo3" for product "Typo3" and version " >= 4.7.0 < 4.7.4"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				6.0 Search vendor "Debian" for product "Debian Linux" and version "6.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0"		-		Affected