CVE-2013-4250
Last modified
CVE-2013-4250 is a vulnerability of currently unknown severity. The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.. EPSS estimates a 1.15% chance of exploitation in the next 30 days.
Description
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Typo3 | Typo3 | 6.0 |
| Typo3 | Typo3 | 6.0.1 |
| Typo3 | Typo3 | 6.0.2 |
| Typo3 | Typo3 | 6.0.3 |
| Typo3 | Typo3 | 6.0.4 |
| Typo3 | Typo3 | 6.0.5 |
| Typo3 | Typo3 | 6.0.6 |
| Typo3 | Typo3 | 6.0.7 |
| Typo3 | Typo3 | 6.0.9 |
| Typo3 | Typo3 | 6.1 |
| Typo3 | Typo3 | 6.1.1 |
| Typo3 | Typo3 | 6.1.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-4250?
How severe is CVE-2013-4250?
How do I fix CVE-2013-4250?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-4244The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 a…
- CVE-2013-4245Orca has arbitrary code execution due to insecure Python mod…7.3
- CVE-2013-4246libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2…
- CVE-2013-4247Off-by-one error in the build_unc_path_to_root function in f…
- CVE-2013-4248The openssl_x509_parse function in openssl.c in the OpenSSL …
- CVE-2013-4249Cross-site scripting (XSS) vulnerability in the AdminURLFiel…
- CVE-2013-4251The scipy.weave component in SciPy before 0.12.1 creates ins…7.8
- CVE-2013-4252Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2013-4253The deployment script in the unsupported "OpenShift Extras" …7.5
- CVE-2013-4254The validate_event function in arch/arm/kernel/perf_event.c …
- CVE-2013-4255The policy definition evaluator in Condor 7.5.4, 8.0.0, and …
- CVE-2013-4256Multiple stack-based and heap-based buffer overflows in Netw…
Are you affected by CVE-2013-4250?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST