Executive brief
A critical security flaw was found in TYPO3 CMS, a popular web content management system. The vulnerability exists in the Extbase framework, which handles how the system processes specific web requests. An attacker could exploit this to bypass security checks, potentially allowing them to steal sensitive data or take full control of the website. Organizations using affected versions should update immediately to prevent unauthorized access or service disruption.
Technical details
A missing access check vulnerability exists in the Extbase request handling component of TYPO3 CMS. The root cause is a failure to validate requested controller/action combinations, allowing an attacker to trigger arbitrary Extbase actions via crafted HTTP requests. If a TYPO3 installation has at least one publicly accessible Extbase plugin or module, the vulnerability can be exploited without authentication; otherwise, it requires an authenticated backend user with access to an Extbase-based module. Successful exploitation can lead to full remote code execution (RCE) or sensitive data exposure depending on the available actions. The issue is resolved in versions 6.2.24, 7.6.8, and 8.1.1.
Affected products
- TYPO3 TYPO3 CMS 4.3.0 to 6.2.23, 7.x to 7.6.7, 8.1.1
Timeline
- 2016-05-24: advisory: Vendor security bulletin TYPO3-CORE-SA-2016-013 released
- 2016-05-24: patched: Fixed versions 6.2.24, 7.6.8, and 8.1.1 released
- 2017-01-23: disclosed: NVD publication date