CVE-2021-43562
High
Description
An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it to a user-controlled filename, which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPixxio Pixx.io
PublishedNov 10, 2021
First seenNov 10, 2021
How to fix
Update
- pixxio pixx.io1.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pixxio pixx.io | v < 1.0.6 | 1.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.