CVE-2008-2717 TYPO3 Unrestricted File Upload vulnerability
Remote attackers can bypass file upload restrictions to upload malicious configuration files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-2717?
CVE-2008-2717 is a medium-severity vulnerability in Typo3 Typo3, published on 16 Jun 2008. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
Weakness: CWE-264
Which versions are affected by CVE-2008-2717?
6 open source packages ship an affected version, including typo3/cms-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms-core Packagist | From 4.0.0 | 4.0.9 |
typo3/cms-core Packagist | From 4.0.0 | 4.0.9 |
typo3/cms-core Packagist | From 4.1.0 | 4.1.7 |
typo3/cms-core Packagist | From 4.1.0 | 4.1.7 |
typo3/cms-core Packagist | From 4.2.0 | 4.2.1 |
typo3/cms-core Packagist | From 4.2.0 | 4.2.1 |
Products include Apache Apache Webserver, Typo3 Typo3.
How do I fix CVE-2008-2717?
Upgrade typo3/cms-core to a fixed version for your release line: 4.0.9, 4.1.7 or 4.2.1.
Is CVE-2008-2717 being exploited?
There is no known exploitation of CVE-2008-2717 in the wild and no public exploit code.
Sources
Also known as GHSA-f35p-hcwf-9f9f.