{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-09-04T00:00:00", "descriptions": [{"lang": "en", "value": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-05-20T12:57:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2013-4321", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/", "refsource": "CONFIRM", "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/"}]}}}}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-4321", "datePublished": "2014-05-20T14:00:00", "dateReserved": "2013-06-12T00:00:00", "dateUpdated": "2014-05-20T12:57:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:6.1:*:*:*:*:*:*:*", "matchCriteriaId": "C140F242-CF7C-4CB6-A358-5C8DB0F26DAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "81EAC0BA-B6AC-42BA-AEEE-946E1FBD770B", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "AD31180A-8BD6-49AC-A758-5FA4C9A7B4C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "E06A3B0C-364F-42A3-803B-6CE1EAB386C8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "84C095F8-000A-4A8D-81DE-047810345A15", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "976AAF6F-BF03-40B7-B7D2-22101BD857D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "6E98D0D9-D9AE-44F7-8233-F92EB330B152", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "36EA784A-7C3A-41DA-B444-D01E3BC144BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "7294AA8B-0CD3-47A2-91DC-A882F7F3BDFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "4D28DD85-FBB3-4DD4-B525-7AFD32BE55F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "80C21E07-5083-4C86-AA9D-FCB73F636060", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:6.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "5DAE1BB4-2DBD-489E-B3F9-88CF414EAC2C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250."}, {"lang": "es", "value": "File Abstraction Layer (FAL) en TYPO3 6.0.x anterior a 6.0.8 y 6.1.x anterior a 6.1.4 permite a editores remotos autenticados ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de caracteres no especificados en la extensi\u00f3n de archivo cuando renombran un archivo. NOTA: esta vulnerabilidad existe debido a una soluci\u00f3n incompleta para CVE-2013-4250."}], "id": "CVE-2013-4321", "lastModified": "2014-05-21T17:39:08.640", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-05-20T14:55:04.270", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}