CVE-2012-3527

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."

Metrics

CVSS 2.0 4.6/10AV:N/AC:H/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/84773Broken Link
http://secunia.com/advisories/50287Not Applicable
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/Vendor Advisory
http://www.debian.org/security/2012/dsa-2537Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/22/8Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/77791Third Party Advisory, VDB Entry
http://osvdb.org/84773Broken Link
http://secunia.com/advisories/50287Not Applicable
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/Vendor Advisory
http://www.debian.org/security/2012/dsa-2537Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/22/8Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/77791Third Party Advisory, VDB Entry

Timeline

Published: Sep 5, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-35283.5Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 CVE-2012-35293.5The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated CVE-2012-35304.3Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x b CVE-2012-35314.3Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows CVE-2012-35326.8Cross-site request forgery (CSRF) vulnerability in the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 and earlier allows CVE-2012-35335.0The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which CVE-2012-35345.0GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of se CVE-2012-35356.8Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possib CVE-2012-35366.1Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could CVE-2012-35374.6The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier CVE-2012-35383.3Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administ CVE-2012-35405.8Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users