Test ID:	1.3.6.1.4.1.25623.1.0.108058
Category:	Web application abuses
Title:	TYPO3 Extbase RCE Vulnerability (TYPO3-CORE-SA-2016-013)
Summary:	TYPO3 is prone to a remote code execution (RCE) vulnerability.
Description:	Summary: TYPO3 is prone to a remote code execution (RCE) vulnerability. Vulnerability Insight: Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. Vulnerability Impact: A remote attacker can leverage this issue to execute arbitrary code within the context of the application. Successful exploits will compromise the application and possibly the underlying system. Affected Software/OS: TYPO3 versions 4.3.0 through 6.2.23, 7.x prior to 7.6.8 and 8.1.0 only. Solution: Update to version 6.2.24, 7.6.8, 8.1.1 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-5091 http://www.openwall.com/lists/oss-security/2016/05/25/4 http://www.openwall.com/lists/oss-security/2016/05/26/2
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.