VULNERABILITY INTELLIGENCE

CVE-2010-3663

CVSS score8.8 HIGH

EPSS probability2.40%

CISA KEVNot currently listed

Published2019-11-04

Last modified2026-06-16

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.

Weakness classification

CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references

cve@mitre.org — Mailing List, Third Party Advisory
cve@mitre.org — Third Party Advisory
cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory