oss-security - CVE request: TYPO3-EXT-SA-2014-001

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20140905074507.GA17689@kludge.henri.nerv.fi>
Date: Fri, 5 Sep 2014 10:45:07 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: TYPO3 Security Team <security@...o3.org>
Subject: CVE request: TYPO3-EXT-SA-2014-001

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Can I get three 2014 CVEs for TYPO3-EXT-SA-2014-001, thanks. One CVE might be
enough as per same reporters and fixed in version.

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/
http://osvdb.org/103255
http://osvdb.org/103256
http://osvdb.org/103257

It has been discovered that the extension "mm_forum" (mm_forum) is vulnerable to
Arbitrary Code Execution, Cross-Site Scripting and Cross-Site Request Forgery.

Release Date: February 12, 2014
Affected Versions: Version 1.9.2 and below
Vulnerability Type: Arbitrary Code Execution, Cross-Site Scripting and
Cross-Site Request Forgery (CSRF).

Severity: Critical
Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C

Problem Description: Failing to properly sanitize user-supplied input the
extension is vulnerable to Cross-Site Scripting. It was possible to upload
arbitrary files as files were not checked against the file deny pattern, thus
Arbitrary Code Execution was possible by uploading PHP files. Additionally it
was possible to create posts on behalf of logged in users (CSRF).

Solution: An updated version 1.9.3 is available from the TYPO3 extension manager
and at http://typo3.org/extensions/repository/download/mm_forum/1.9.3/t3x/.
Users of the extension are advised to update the extension as soon as possible.

Credits: Credits go to Michael Knabe and Stano Paska who discovered and reported
the issue.

- ---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlQJagMACgkQXf6hBi6kbk9qjwCg0+G4rJGGPPV+ZV5eiW6AFB9L
2esAn2QCte+R0/4IVV2Z93U4tc9ZsHFz
=1KRZ
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.