-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, < 6.2.25 | 6.2.25 |
| typo3/cms | composer | >= 7.6.0, < 7.6.8 | 7.6.8 |
| typo3/cms | composer | >= 8.0.0, < 8.1.1 | 8.1.1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability centers on missing access checks in Extbase's request handling. The primary vulnerable function is the Dispatcher::dispatch() method, which directly executes controller actions without authorization in unpatched versions. The FrontendRequestHandler::handleRequest() is also implicated as it initiates the vulnerable request processing flow. These functions would appear in exploitation stack traces as they handle action resolution and execution. The high confidence for Dispatcher::dispatch() aligns with TYPO3's security bulletin describing Extbase's failure to validate() controller/action access during dispatch.
Ongoing coverage of React2Shell