Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can trigger a Cross Site Request Forgery of TYPO3, in
order to force the victim to perform operations.

Impacted products: TYPO3 Core

Severity: 2/4

Creation date: 31/01/2014

DESCRIPTION OF THE VULNERABILITY

The TYPO3 product offers a web service.

However, the origin of queries is not checked in several places:
– extension manager
– file upload
– configuration module

They can for example originate from an image included in an HTML
document.

An attacker can therefore trigger a Cross Site Request Forgery of
TYPO3, in order to force the victim to perform operations.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/TYPO3-Cross-Site-Request-Forgery-14163