The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1ad3d264-e36b-11ee-9c27-40b034429ecf advisory.

  - In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to     read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST     /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
    (CVE-2023-30451)

  - TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute     arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in     form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35     LTS, 12.4.11 LTS, and 13.0.1. (CVE-2024-22188)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password     hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed     attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability     requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46     ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known     workarounds for this issue. (CVE-2024-25118)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext     value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool     user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for     verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an     administrator-level backend user account with system maintainer permissions. Users are advised to update     to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the     problem described. There are no known workarounds for this vulnerability. (CVE-2024-25119)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. The     TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission     scope. This encompassed files, folders, pages, and records (although only if a valid link-handling     configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users     are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS,     13.0.1 that fix the problem described. There are no known workarounds for this issue. (CVE-2024-25120)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected     versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via     `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve     their file names and contents. The fallback storage (zero-storage) is used as a backward compatibility     layer for files located outside properly configured file storages and within the public web root     directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to     update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which     fix the problem described. When persisting entities of the File Abstraction Layer directly via     DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata`     entities are not permitted to reference files in the fallback storage anymore. When importing data from     secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using     `$dataHandler->isImporting = true;`. (CVE-2024-25121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

FreeBSD : typo3-{11,12} -- multiple vulnerabilities (1ad3d264-e36b-11ee-9c27-40b034429ecf)

high Nessus Plugin ID 192184

Version 1.1

Version 1.0

Version 1.1 Oct 18, 2024, 9:34 AM CVSS metrics ("CVSSv2 score" set to 7.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N") CVSSv2 score source (changed from "CVE-2023-30451" to "CVE-2024-25121") CVSSv2 severity (based on CVE-2024-25121, severity increased from "Medium" to "High") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin Feed: 202410180934
Version 1.0 Mar 17, 2024, 8:49 AM New Plugin Feed: 202403170849