Allele Security Alert
ASA-2019-00419
Identifier(s)
ASA-2019-00419, TYPO3-CORE-SA-2019-020
Title
Insecure Deserialization
Vendor(s)
TYPO3 Association
Product(s)
TYPO3 CMS
Affected version(s)
TYPO3 CMS versions 8.0.0 to 8.7.26
TYPO3 CMS versions 9.0.0 to 9.5.7
Fixed version(s)
TYPO3 CMS version 8.7.27
TYPO3 CMS version 9.5.8
Proof of concept
Unknown
Description
It has been discovered that FormEngine and DataHandler are vulnerable to insecure deserialization. A valid backend user account is needed in order to exploit this vulnerability.
Technical details
Unknown
Credits
Robin Peraglie (RIPS technologies)
Reference(s)
TYPO3 9.5.8 and 8.7.27 security releases published
https://typo3.org/article/typo3-958-and-8727-security-releases-published/
TYPO3-CORE-SA-2019-020: Insecure Deserialization in TYPO3 CMS
https://typo3.org/security/advisory/typo3-core-sa-2019-020/
[TYPO3-announce] Announcing TYPO3 v9.5.8 and v8.7.27 security releases
http://lists.typo3.org/pipermail/typo3-announce/2019/000447.html
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: July 11, 2019