CVE-2020-15086

CVE-2020-15086, GHSA-4h44-w6fm-548g

packagist/friendsoftypo3/mediace

Deserialization of Untrusted Data

In TYPO3 installations with the mediace extension, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation.

All versions starting from 7.6.2 before 7.6.5

Upgrade to version 7.6.5 or above.

2020-08-06