-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in the Import/Export module (ext:impexp). The ImportController's actions and access checks did not enforce the required admin privileges or TSconfig validation, allowing non-admin users to exploit the import functionality. This aligns with the CWE-284 (Improper Access Control) pattern, where missing authorization checks in critical functions lead to privilege escalation. The high confidence stems from the direct correlation between the described vulnerability (unauthorized import access) and the controller methods governing import functionality and permissions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 9.0.0, < 9.5.8 | 9.5.8 |