CVE-2017-14251

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-14251
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14251.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-14251
Aliases
Published
2017-09-11T09:29:00.467Z
Modified
2026-05-28T04:03:42.426146215Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "7.6.0"
                },
                {
                    "last_affected": "7.6.0"
                }
            ],
            "vendor_product": "typo3:typo3",
            "cpes": [
                "cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/benjaminkott/bootstrap_package

Affected ranges

Type
GIT
Repo
https://github.com/benjaminkott/bootstrap_package
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2948aa3f9c34483477af9d18f89423eae07ede34
Last affected
86bdd2dec46ddc0c25c65b4695160ae14b3b4679
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0.0"
        },
        {
            "last_affected": "8.0.1"
        }
    ],
    "cpe": [
        "cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING"
}

Affected versions

6.*
6.2.10
6.2.11
6.2.12
6.2.13
6.2.14
6.2.15
6.2.4
6.2.5
6.2.6
6.2.7
6.2.8
6.2.9
7.*
7.0.0
7.1.0
8.*
8.0.0
8.0.1
v6.*
v6.2.10
v6.2.11
v6.2.12
v6.2.13
v6.2.14
v6.2.15
v6.2.4
v6.2.5
v6.2.6
v6.2.7
v6.2.8
v6.2.9
v7.*
v7.0.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14251.json"

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a2585ba26b9df87ef67fdbb4f53d2f1a891d919f
Last affected
e889c3dc9ae1265ab8570f4bf88002a8c8e7e8cd
Last affected
124f5470b931f06fd2e6ecc2cbe46221375c863a
Last affected
654c6751a04ef60c5a3f7a95ac0b11cd8e06a742
Last affected
bd0c7f6ca9cb3093bd647e85035e9f36bf1e9e86
Last affected
3809f75057d2651bc42dd1d9980a4f96f10301df
Last affected
7a6112192ecdb3f82f59a1d89e075406546b5988
Last affected
23f9f11c7150054885c92a0f2db0a5682a9acfcf
Last affected
02c1c1744cc8437df58f94bdeb2b88c9a82b73b1
Last affected
ecc552537efb1bfe184c7e1d8b1e79facf0a2c20
Last affected
540f30a1072c77ae377198a337924b2b1b338e9f
Last affected
e6580859412b5a9bb508ba8a8be0db5bc2ba166b
Last affected
6c158c9afb959bda715e66aff8cf764fe29258e3
Last affected
1a295a64c200bfffe7b0f595f71146670c5ccb9b
Last affected
9de61953bd98bebfbf7cc985896009db4245c24b
Last affected
83c94ad5ee39aa4faeebfdd8d0eb66a7450f2ab1
Last affected
4cf10b1d32c1c4c074d14cacba64890640937015
Last affected
dc0e7ac33250302f0ef5affea50737d15203fd8b
Last affected
9219e4fa9af5e4bd2ea1f208056cb396667cce45
Last affected
7e72aa52ef9631112276820a20cf3e1a1f1d82db
Last affected
ecb6538c2380f46c03b914eea48b6d5da9ab1f5d
Last affected
a32a598fd6c4c0e671e28d83aa94df095596c333
Last affected
a9a68ed6a41c86e6d46629c15ca4bdffe85344f1
Last affected
22458921d7ce084db37edcc1a6851de97a740709
Last affected
a8092e52750e3ba88f17357a2b2813ca3e4d9ee6
Last affected
0833baed1fedfc868c64330fc8dc348b8c07ce02
Last affected
e324debe08f557d7e0b22e180f7e25bc6ddd3ad2
Last affected
46014e2af8ce9081dc4183ba3490e829231a0bbd
Last affected
2ecfc86fbd4bf3cd9e6ae7b5eece7847ba1c7636
Last affected
ce3a12b18327f3fa232fa00e94f7c6fd57b55743
Last affected
aa6163301999945a7c1ff57151a1c6aaffea1534
Last affected
e67cfa06065c24ba90a728667f5366c4f6653744
Last affected
60da75ab81b4626983fbe7d4adac20322b3f39bb
Last affected
aa94fbd7a11544229105ed9ac7c6c55144648ea8
Last affected
37ad0060363bfee3bc7acecbd68fe67cec819360
Last affected
1f1c186b1b698136a4fff59aaa34466fc7d15e45
Last affected
5ef31ecdde74ae11e33290d59751c5292291e303
Last affected
f4aa757eef23411a47f9172580eb0808c90c0eaf
Last affected
5e3a0e4f2124311f9676155580d0794cb1051a2c
Last affected
e05c6943b1ce5999dddb26f2acf0a14bc73f3a81
Last affected
0356a94c3e9846df9ed55d2fd15cd5beced3ee4a
Last affected
c7c31332ac2222d03f29be627de34bb58bde0954
Database specific 
{
    "cpe": [
        "cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:7.6.21:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.1.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.2.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.3.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.5.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.5.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:typo3:typo3:8.7.4:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.6.0"
        },
        {
            "last_affected": "7.6.1"
        },
        {
            "last_affected": "7.6.2"
        },
        {
            "last_affected": "7.6.3"
        },
        {
            "last_affected": "7.6.4"
        },
        {
            "last_affected": "7.6.5"
        },
        {
            "last_affected": "7.6.6"
        },
        {
            "last_affected": "7.6.7"
        },
        {
            "last_affected": "7.6.8"
        },
        {
            "last_affected": "7.6.9"
        },
        {
            "last_affected": "7.6.10"
        },
        {
            "last_affected": "7.6.11"
        },
        {
            "last_affected": "7.6.12"
        },
        {
            "last_affected": "7.6.13"
        },
        {
            "last_affected": "7.6.14"
        },
        {
            "last_affected": "7.6.15"
        },
        {
            "last_affected": "7.6.16"
        },
        {
            "last_affected": "7.6.17"
        },
        {
            "last_affected": "7.6.18"
        },
        {
            "last_affected": "7.6.19"
        },
        {
            "last_affected": "7.6.20"
        },
        {
            "last_affected": "7.6.21"
        },
        {
            "last_affected": "8.0.0"
        },
        {
            "last_affected": "8.0.1"
        },
        {
            "last_affected": "8.1.0"
        },
        {
            "last_affected": "8.1.1"
        },
        {
            "last_affected": "8.1.2"
        },
        {
            "last_affected": "8.2.0"
        },
        {
            "last_affected": "8.2.1"
        },
        {
            "last_affected": "8.3.0"
        },
        {
            "last_affected": "8.3.1"
        },
        {
            "last_affected": "8.4.0"
        },
        {
            "last_affected": "8.4.1"
        },
        {
            "last_affected": "8.5.0"
        },
        {
            "last_affected": "8.5.1"
        },
        {
            "last_affected": "8.6.0"
        },
        {
            "last_affected": "8.6.1"
        },
        {
            "last_affected": "8.7.0"
        },
        {
            "last_affected": "8.7.1"
        },
        {
            "last_affected": "8.7.2"
        },
        {
            "last_affected": "8.7.3"
        },
        {
            "last_affected": "8.7.4"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

6.*
6.2.0
6.2.1
6.2.2
6.2.3
7.*
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.10
7.6.11
7.6.12
7.6.13
7.6.14
7.6.15
7.6.16
7.6.17
7.6.18
7.6.19
7.6.2
7.6.20
7.6.21
7.6.3
7.6.4
7.6.5
7.6.6
7.6.7
7.6.8
7.6.9
8.*
8.0.0
8.0.1
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.3.0
8.3.1
8.4.0
8.4.1
8.5.0
8.5.1
8.6.0
8.6.1
8.7.0
8.7.1
8.7.2
8.7.3
8.7.4
Other
TYPO3_6-1-0rc1
TYPO3_6-2-0
TYPO3_6-2-0alpha1
TYPO3_6-2-0alpha2
TYPO3_6-2-0alpha3
TYPO3_6-2-0beta1
TYPO3_6-2-0beta2
TYPO3_6-2-0beta3
TYPO3_6-2-0beta4
TYPO3_6-2-0beta5
TYPO3_6-2-0beta6
TYPO3_6-2-0beta7
TYPO3_6-2-0rc1
TYPO3_6-2-0rc2
TYPO3_6-2-1
TYPO3_6-2-2
TYPO3_6-2-3
TYPO3_7-0-0
TYPO3_7-1-0
TYPO3_7-2-0
TYPO3_7-3-0
TYPO3_7-4-0
TYPO3_7-5-0
TYPO3_7-6-0
TYPO3_7-6-1
TYPO3_7-6-10
TYPO3_7-6-11
TYPO3_7-6-12
TYPO3_7-6-13
TYPO3_7-6-14
TYPO3_7-6-15
TYPO3_7-6-16
TYPO3_7-6-17
TYPO3_7-6-18
TYPO3_7-6-19
TYPO3_7-6-2
TYPO3_7-6-20
TYPO3_7-6-21
TYPO3_7-6-3
TYPO3_7-6-4
TYPO3_7-6-5
TYPO3_7-6-6
TYPO3_7-6-7
TYPO3_7-6-8
TYPO3_7-6-9
TYPO3_8-0-0
TYPO3_8-0-1
TYPO3_8-1-0
TYPO3_8-1-1
TYPO3_8-1-2
TYPO3_8-2-0
TYPO3_8-2-1
TYPO3_8-3-0
TYPO3_8-3-1
TYPO3_8-4-0
TYPO3_8-4-1
TYPO3_8-5-0
TYPO3_8-5-1
TYPO3_8-6-0
TYPO3_8-6-1
TYPO3_8-7-0
TYPO3_8-7-1
TYPO3_8-7-2
TYPO3_8-7-3
TYPO3_8-7-4
v7.*
v7.6.20
v7.6.21
v8.*
v8.7.3
v8.7.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14251.json"