Description
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
Remediation
References
Related Vulnerabilities
Oracle Application Server CVE-2007-3854 Vulnerability (CVE-2007-3854)
WordPress Plugin Powerplay Gallery 'upload.php' Arbitrary File Upload (3.2)
WordPress Plugin WP Quick FrontEnd Editor Multiple Vulnerabilities (5.5)
WordPress Plugin Weather Effect-Christmas Santa Snow Falling Cross-Site Scripting (1.3.5)