==================================================================== CERT-Renater Note d'Information No. 2015/VULN126 _____________________________________________________________________ DATE : 03/07/2015 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running typo3-core versions 6, 7 prior to 6.2.14, 7.3.1. ====================================================================== https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-004/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-005/ ______________________________________________________________________ TYPO3-CORE-SA-2015-002: Access bypass when editing file metadata July 01, 2015 Category: TYPO3 CMS Author: Helmut Hummel Keywords: TYPO3 CMS, Access Bypass It has been discovered, that editors could change, create or delete metadata of files without permission. Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Broken Access Control Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:P/A:N/E:F/RL:OF/RC:C CVE: not assigned yet Problem Description: It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts. Solution: Update to TYPO3 versions 6.2.14 or 7.3.1 that fix the problem described. Credits: Thanks to Marc Bastian Heinrichs who discovered and reported the issue. General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list. General Note: All security related code changes are tagged so that you can easily look them up on our review system. - --------------------------------------------------------------------------- TYPO3-CORE-SA-2015-003: Frontend login Session Fixation July 01, 2015 Category: TYPO3 CMS Author: Helmut Hummel Keywords: TYPO3 CMS, Session Fixation It has been discovered that TYPO3 is susceptible to session fixation. Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Frontend Logon Vulnerability Type: Session Fixation Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:F/RL:OF/RC:C CVE: not assigned yet Problem Description: It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session. Solution: Update to TYPO3 versions 6.2.14 or 7.3.1 that fix the problem described. Credits: Thanks to Helmut Hummel who discovered and reported the issue. General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list. General Note: All security related code changes are tagged so that you can easily look them up on our review system. - ------------------------------------------------------------------------- TYPO3-CORE-SA-2015-004: Cross-Site Scripting exploitable by Editors July 01, 2015 Category: TYPO3 CMS Author: Helmut Hummel Keywords: TYPO3 CMS, Cross-Site Scripting It has been discovered, that TYPO3 is susceptible to Cross-Site Scripting Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Cross-Site Scripting Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:OF/RC:C CVE: not assigned yet Problem Description: Failing to properly HTML encode input from editors (page titles in links and file names), TYPO3 is vulnerable to Cross-Site Scripting. Solution: Update to TYPO3 versions 6.2.14 or 7.3.1 that fix the problem described. Credits: Thanks to Marc Bastian Heinrichs who discovered and reported the issue. General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list. General Note: All security related code changes are tagged so that you can easily look them up on our review system. - ------------------------------------------------------------------------- TYPO3-CORE-SA-2015-005: Information Disclosure possibility exploitable by Editors July 01, 2015 Category: TYPO3 CMS Author: Helmut Hummel Keywords: TYPO3 CMS, Information Disclosure It has been discovered, that editors could list all files and folders in the root directory of a TYPO3 installation. Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Information Disclosure Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:F/RL:OF/RC:C CVE: not assigned yet Problem Description: It has been discovered, that editors with access to the file list module could list all files and folders in the root directory of a TYPO3 installation. Modification of files or listing further nested directories was not possible. Solution: Update to TYPO3 versions 6.2.14 or 7.3.1 that fix the problem described. Credits: Thanks to Helmut Hummel who discovered and reported the issue. General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list. General Note: All security related code changes are tagged so that you can easily look them up on our review system. ========================================================= Serveur de référence du CERT-Renater https://services.renater.fr/ssi/ ========================================================== + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: cert@support.renater.fr + ==========================================================