Is CVE-2016-5091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-5091 being exploited in the wild.

How severe is CVE-2016-5091?

High severity, with a CVSS score of 8.1, published 23 January 2017.

Which products and versions are affected?

typo3/cms-extbase (Packagist) ECOSYSTEM:introduced=0,fixed=6.2.24.

Is there a fix for CVE-2016-5091?

Yes. typo3/cms-extbase (Packagist): upgrade to 6.2.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-5091 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2016-5091?

Check whether you run typo3/cms-extbase (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5091: TYPO3 CMS missing access check in Extbase

CVE-2016-5091 · Severity: high · CVSS 8.1 · Published 2017-01-23

A critical security flaw was found in TYPO3 CMS, a popular web content management system. The vulnerability exists in the Extbase framework, which handles how the system processes specific web requests. An attacker could exploit this to bypass security checks, potentially allowing them to steal sensitive data or take full control of the website. Organizations using affected versions should update immediately to prevent unauthorized access or service disruption.

Vendors: Packagist.

Quick answers

Is CVE-2016-5091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-5091 being exploited in the wild.
How severe is CVE-2016-5091?: High severity, with a CVSS score of 8.1, published 23 January 2017.
Which products and versions are affected?: typo3/cms-extbase (Packagist) ECOSYSTEM:introduced=0,fixed=6.2.24.
Is there a fix for CVE-2016-5091?: Yes. typo3/cms-extbase (Packagist): upgrade to 6.2.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-5091 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2016-5091?: Check whether you run typo3/cms-extbase (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

typo3/cms-extbase (Packagist): upgrade to 6.2.24 or later
```
composer require typo3/cms-extbase:^6.2.24
```

Technical details

A missing access check vulnerability exists in the Extbase request handling component of TYPO3 CMS. The root cause is a failure to validate requested controller/action combinations, allowing an attacker to trigger arbitrary Extbase actions via crafted HTTP requests. If a TYPO3 installation has at least one publicly accessible Extbase plugin or module, the vulnerability can be exploited without authentication; otherwise, it requires an authenticated backend user with access to an Extbase-based module. Successful exploitation can lead to full remote code execution (RCE) or sensitive data exposure depending on the available actions. The issue is resolved in versions 6.2.24, 7.6.8, and 8.1.1.

Affected products

TYPO3 TYPO3 CMS 4.3.0 to 6.2.23, 7.x to 7.6.7, 8.1.1

Identifiers

CVE-2016-5091
GHSA-jxg5-35fj-ccwf

Timeline

2016-05-24: advisory: Vendor security bulletin TYPO3-CORE-SA-2016-013 released
2016-05-24: patched: Fixed versions 6.2.24, 7.6.8, and 8.1.1 released
2017-01-23: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.