Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01OThwLXJ2NnAtZzdxY84AAiZx

sr_freecap for Typo3 RCE Vulnerability

The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.

Permalink: https://github.com/advisories/GHSA-598p-rv6p-g7qc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01OThwLXJ2NnAtZzdxY84AAiZx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 8 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-598p-rv6p-g7qc, CVE-2019-16699
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-16699
• https://extensions.typo3.org/extension/sr_freecap
• https://typo3.org/security/advisory/typo3-ext-sa-2019-018/
• https://github.com/advisories/GHSA-598p-rv6p-g7qc

Blast Radius: 4.7

Affected Packages