php · typo3/cms-coreCritical
typo3/cms-core: Missing authorization check allows non-privileged users to modify root folders of file mounts
Non-privileged backend users with file mount access could perform write operations (move, delete, rename) on root folders of active file mounts due to missing a
What changed
Non-privileged backend users with file mount access could perform write operations (move, delete, rename) on root folders of active file mounts due to missing authorization restrictions.
Who it affects
TYPO3 CMS versions before 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS.
What to do today
Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, or 14.3.3 LTS.
The trail
Collected→
Audited→
Written→
Published