CVE-2008-2717

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-06-16 · updated 2026-06-16
Weakness: CWE-264

Description

TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.

Affected products

Apache Webserver: all versions
typo3: 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+11)

References

http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/
http://secunia.com/advisories/30619
http://secunia.com/advisories/30660
http://securityreason.com/securityalert/3945
http://typo3.org/teams/security/security-bulletins/typo3-20080611-1/
http://www.debian.org/security/2008/dsa-1596
http://www.securityfocus.com/archive/1/493270/100/0/threaded
http://www.securityfocus.com/bid/29657
http://www.vupen.com/english/advisories/2008/1802
https://exchange.xforce.ibmcloud.com/vulnerabilities/42988
http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/
http://secunia.com/advisories/30619

Get alerted when CVE-2008-2717 or the next vulnerability affects your stack