{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-09-04T00:00:00", "descriptions": [{"lang": "en", "value": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-05-20T12:57:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2013-4320", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/", "refsource": "CONFIRM", "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/"}]}}}}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-4320", "datePublished": "2014-05-20T14:00:00", "dateReserved": "2013-06-12T00:00:00", "dateUpdated": "2014-05-20T12:57:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:6.1:*:*:*:*:*:*:*", "matchCriteriaId": "C140F242-CF7C-4CB6-A358-5C8DB0F26DAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "81EAC0BA-B6AC-42BA-AEEE-946E1FBD770B", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "AD31180A-8BD6-49AC-A758-5FA4C9A7B4C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "E06A3B0C-364F-42A3-803B-6CE1EAB386C8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "84C095F8-000A-4A8D-81DE-047810345A15", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "976AAF6F-BF03-40B7-B7D2-22101BD857D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "6E98D0D9-D9AE-44F7-8233-F92EB330B152", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "36EA784A-7C3A-41DA-B444-D01E3BC144BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "7294AA8B-0CD3-47A2-91DC-A882F7F3BDFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "4D28DD85-FBB3-4DD4-B525-7AFD32BE55F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "80C21E07-5083-4C86-AA9D-FCB73F636060", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "5DAE1BB4-2DBD-489E-B3F9-88CF414EAC2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "0724FE19-F0A4-4055-996A-2B7844CAC426", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL."}, {"lang": "es", "value": "File Abstraction Layer (FAL) en TYPO3 6.0.x anterior a 6.0.9 y 6.1.x anterior a 6.1.4 no comprueba debidamente permisos, lo que permite a usuarios remotos autenticados crear o leer archivos arbitrarios a trav\u00e9s de una URL manipulada."}], "id": "CVE-2013-4320", "lastModified": "2014-05-21T13:08:07.500", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-05-20T14:55:04.207", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}