CVE-2011-4902: Typo3 Arbitrary File Delete
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.35503%
CWE
Published
4/22/2022
Updated
1/12/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | < 4.3.12 | 4.3.12 |
| typo3/cms | composer | >= 4.4.0, < 4.4.9 | 4.4.9 |
| typo3/cms | composer | >= 4.5.0, < 4.5.4 | 4.5.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The TYPO3 security advisory explicitly identifies an 'Unserialize() vulnerability' where user input is deserialized, enabling arbitrary file deletion. The core issue is improper input validation (CWE-20) when processing serialized data. While the exact file/function isn't named in public sources, TYPO3's GeneralUtility class is a common location for core utilities like unserialize() operations. The high confidence stems from the direct match between the described attack vector (untrusted deserialization) and PHP's unserialize() function's known risks when used with untrusted input.