CVE-2020-15086
Critical
Description
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3.
SeverityCritical
CVSS9.8
Exploit probability89. percentile3.6%
Product
Typo3 Mediace
PublishedJul 29, 2020
First seenJul 29, 2020
How to fix
Update
- typo3 mediace7.6.5 or later
- friendsoftypo3/mediace7.6.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3 mediace | 7.6.2 ≤ v < 7.6.5 | 7.6.5 |
| friendsoftypo3/mediacePackagist | 7.6.2 ≤ v < 7.6.5 | 7.6.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.