GHSA-c7rj-92xr-wprg
Insecure Unserialize in TYPO3 Backend
GHSA-c7rj-92xr-wprg is a medium vulnerability (CVSS 5.0) in typo3/cms, published June 5, 2024. No source lists public exploit code. Fixed in typo3/cms 6.2.29.
- Severity
- 5.0 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.2.29typo3/cms +5 more
Description
Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 6.2.0 up to 6.2.29 | 6.2.29 |
typo3/cmsPackagist | 7.6.0 up to 7.6.13 | 7.6.13 |
typo3/cmsPackagist | 8.0.0 up to 8.4.1 | 8.4.1 |
typo3/cmsPackagist | 6.2.0 up to 6.2.29, plus listed versions 6.2.16.2.106.2.10-rc16.2.116.2.12 Show 24 moreShow less6.2.136.2.146.2.156.2.166.2.176.2.186.2.196.2.26.2.206.2.216.2.226.2.236.2.246.2.256.2.266.2.276.2.286.2.36.2.46.2.56.2.66.2.76.2.86.2.9 | 6.2.29 |
typo3/cmsPackagist | 7.6.0 up to 7.6.13, plus listed versions 7.6.17.6.107.6.117.6.127.6.2 Show 7 moreShow less7.6.37.6.47.6.57.6.67.6.77.6.87.6.9 | 7.6.13 |
typo3/cmsPackagist | 8.0.0 up to 8.4.1, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 4 moreShow less8.2.18.3.08.3.18.4.0 | 8.4.1 |
What each source reports
GitHub Advisories Score used
Insecure Unserialize in TYPO3 Backend
Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
- Record
GHSA-c7rj-92xr-wprg- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSV
Insecure Unserialize in TYPO3 Backend
Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
- Record
GHSA-c7rj-92xr-wprg- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.