Description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

Remediation

References

CVE-2013-4320

Related Vulnerabilities

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5230)

WordPress Plugin Simple Download Monitor Multiple Vulnerabilities (3.9.5.1)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2092)

Joomla! Core 1.5.x Directory Traversal (1.5.0 - 1.5.8)

MySQL CVE-2018-2777 Vulnerability (CVE-2018-2777)

Severity

Medium

Classification

CVE-2013-4320 CWE-264

Tags

Missing Update Known Vulnerabilities