CVE-2021-43564 Unrestricted access to predictable file paths in hov/jobfair
Unauthenticated attackers can download sensitive uploaded files by guessing predictable filenames in the TYPO3 Job Fair extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43564?
CVE-2021-43564 is a high-severity vulnerability in n/a, published on 10 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).
Which versions are affected by CVE-2021-43564?
4 open source packages ship an affected version, including hov/jobfair. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hov/jobfair Packagist | All versions | 1.0.13 |
hov/jobfair Packagist | All versions | 1.0.13 |
hov/jobfair Packagist | From 2.0.0 | 2.0.2 |
hov/jobfair Packagist | From 2.0.0 | 2.0.2 |
Products include Job Fair Project Job Fair.
How do I fix CVE-2021-43564?
Upgrade hov/jobfair to a fixed version for your release line: 1.0.13 or 2.0.2.
Is CVE-2021-43564 being exploited?
There is no known exploitation of CVE-2021-43564 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-43g8-79x3-j898.