CVE-2019-19848

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2

Medium · published December 17, 2019

CVSS v3.0
6.8
EPSS
1%
Percentile
73.2
In the wild
Unconfirmed
What it is

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)

The record
Technical detail
CVSS v3.0
6.8 · MEDIUM
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.01452 · 73.2th percentile
Published
2019-12-17T16:02Z
EPSS history
Timeline
  • 17 DEC 16:02Z
    An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2
    cvelistv5