Description

The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.

Remediation

References

CVE-2009-0258

Related Vulnerabilities

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-11876)

Grafana Insufficiently Protected Credentials Vulnerability (CVE-2022-31130)

WordPress Plugin ThemeHigh WooCommerce Wishlist and Comparison Cross-Site Request Forgery (1.0.4)

WordPress Plugin Cart66 Pro Arbitrary File Disclosure (1.5.3)

WebERP Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-22474)

Severity

Critical

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2009-0258