CVE-2012-3527

view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."

• CWE-502

• http://osvdb.org/84773Broken Link
• http://secunia.com/advisories/50287Not Applicable
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/Vendor Advisory
• http://www.debian.org/security/2012/dsa-2537Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/22/8Mailing List
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77791Third Party Advisory, VDB Entry
• http://osvdb.org/84773Broken Link
• http://secunia.com/advisories/50287Not Applicable
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/Vendor Advisory
• http://www.debian.org/security/2012/dsa-2537Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/22/8Mailing List
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77791Third Party Advisory, VDB Entry

Published

Sep 5, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3521Multiple directory traversal vulnerabilities in the cssgen c…
• CVE-2012-3522Cross-site scripting (XSS) vulnerability in contrib/langwiz.…
• CVE-2012-3523The STARTTLS implementation in nnrpd in INN before 2.5.3 doe…
• CVE-2012-3524libdbus 1.5.x and earlier, when used in setuid or other priv…
• CVE-2012-3525s2s/out.c in jabberd2 2.2.16 and earlier does not verify tha…
• CVE-2012-3526The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 …
• CVE-2012-3528Multiple cross-site scripting (XSS) vulnerabilities in the b…
• CVE-2012-3529The configuration module in the backend in TYPO3 4.5.x befor…
• CVE-2012-3530Incomplete blacklist vulnerability in the t3lib_div::quoteJS…
• CVE-2012-3531Cross-site scripting (XSS) vulnerability in the Install Tool…
• CVE-2012-3532Cross-site request forgery (CSRF) vulnerability in the GateI…
• CVE-2012-3533The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVi…