CVE-2019-16700: Unrestricted Upload of File with Dangerous Type

May 24, 2022 (updated August 1, 2023)

The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.

References

extensions.typo3.org/extension/slub_events
github.com/advisories/GHSA-5pww-3mfc-g8vr
nvd.nist.gov/vuln/detail/CVE-2019-16700
typo3.org/security/advisory/typo3-ext-sa-2019-017/

Code Behaviors & Features

Detect and mitigate CVE-2019-16700 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →