NVD

Id
16334  
Name
CVE-2010-5099  
Description
The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2012-05-30  
Modified Date
2012-05-31  
Seq
2010-5099  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
91860 16334 CVE-2010-5099 http://blog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html  View
91861 16334 CVE-2010-5099 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/  View
91862 16334 CVE-2010-5099 15856  View
91863 16334 CVE-2010-5099 [oss-security] 20110113 CVE requests: ftpls, xdigger, lbreakout2, calibre, typo3  View
91864 16334 CVE-2010-5099 [oss-security] 20120511 CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE  View
91865 16334 CVE-2010-5099 [oss-security] 20120510 Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE  View
91866 16334 CVE-2010-5099 [oss-security] 20120512 Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE  View
91867 16334 CVE-2010-5099 typo3-unspecified-file-include(64180)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
37835 JVNDB-2010-003620 TYPO3 の fileDenyPattern 機能におけるアクセス制限を回避される脆弱性 TYPO3 の PHP ファイルインクルージョン保護 API の fileDenyPattern 機能は、ファイルの種類を適切にフィルタリングしないため、アクセス制限の回避、および任意の PHP ファイルへアクセスされる脆弱性が存在します。 CVE-2010-5099 47679 CVE-2010-5099 16334 6.8 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-003620.html 2010-12-16 2012-06-01 View