CVE-2011-4614

Executive Summary

Informations
Name	CVE-2011-4614	First vendor Publication	2012-02-17
Vendor	Cve	Last vendor Modification	2012-02-29

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACK_PATH parameter.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4614

CWE : Common Weakness Enumeration

id	Name
CWE-94	Failure to Control Generation of Code ('Code Injection')

CPE : Common Platform Enumeration

Type	Description	Count
Application	typo3 typo3 cpe:/a:typo3:typo3:4.6.1 cpe:/a:typo3:typo3:4.6 cpe:/a:typo3:typo3:4.5.8 cpe:/a:typo3:typo3:4.5.7 cpe:/a:typo3:typo3:4.5.6 cpe:/a:typo3:typo3:4.5.5 cpe:/a:typo3:typo3:4.5.4 cpe:/a:typo3:typo3:4.5.3 cpe:/a:typo3:typo3:4.5.2 cpe:/a:typo3:typo3:4.5.1 cpe:/a:typo3:typo3:4.5	11

Internal Sources (Detail)

Source	Url
CONFIRM	http://typo3.org/fileadmin/security-team/bug32571/32571.diff http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2...
MLIST	http://www.openwall.com/lists/oss-security/2011/12/16/1
OSVDB	http://www.osvdb.org/77776
SECUNIA	http://secunia.com/advisories/47201