CVE-2019-16699

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-10-16T18:40:40.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://extensions.typo3.org/extension/sr_freecap"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://typo3.org/security/advisory/typo3-ext-sa-2019-018/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-16699", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://extensions.typo3.org/extension/sr_freecap", "refsource": "MISC", "url": "https://extensions.typo3.org/extension/sr_freecap"}, {"name": "https://typo3.org/security/advisory/typo3-ext-sa-2019-018/", "refsource": "CONFIRM", "url": "https://typo3.org/security/advisory/typo3-ext-sa-2019-018/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:17:41.077Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://extensions.typo3.org/extension/sr_freecap"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://typo3.org/security/advisory/typo3-ext-sa-2019-018/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-16699", "datePublished": "2019-10-16T18:40:40.000Z", "dateReserved": "2019-09-22T00:00:00.000Z", "dateUpdated": "2024-08-05T01:17:41.077Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sr_freecap_project:sr_freecap:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC701020-3EFE-40E4-896E-FC659D18925E", "versionEndIncluding": "2.4.5", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sr_freecap_project:sr_freecap:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAE61BCD-5990-485A-988B-7BC6E6DBDA29", "versionEndIncluding": "2.5.2", "versionStartIncluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution."}, {"lang": "es", "value": "La extensi\u00f3n sr_freecap (tambi\u00e9n se conoce como freeCap CAPTCHA) versi\u00f3n 2.4.5 y posteriores y versi\u00f3n 2.5.2 y posteriores para TYPO3 no sanea la entrada del usuario, lo que permite la ejecuci\u00f3n de acciones Extbase arbitrarias, resultando en la ejecuci\u00f3n de c\u00f3digo remota."}], "id": "CVE-2019-16699", "lastModified": "2026-06-17T02:22:37.403", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-16T19:15:15.880", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://extensions.typo3.org/extension/sr_freecap"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://typo3.org/security/advisory/typo3-ext-sa-2019-018/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://extensions.typo3.org/extension/sr_freecap"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://typo3.org/security/advisory/typo3-ext-sa-2019-018/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}