Description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.

Remediation

References

CVE-2013-4320

Related Vulnerabilities

Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-40035)

WordPress Plugin Rank Math SEO-Best SEO For WordPress To Increase Your SEO Traffic Security Bypass (1.0.27)

ownCloud Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2047)

WordPress Plugin WordPress Landing Page-Squeeze Page-Responsive Landing Page Builder Free-WP Lead Plus X Multiple Vulnerabilities (0.98)

SugarCRM Other Vulnerability (CVE-2006-2460)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2013-4320