CVE-2010-1153 — Vulnerability in typo3/cms — CVE Details
TYPO3 PHP remote file inclusion vulnerability
Summary
Advisory Timeline
- First published May 2, 2022 (1624 days ago).
- Last revised April 11, 2025 — 1076 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
composer require "typo3/cms:^4.3.3"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
Affects 1 ecosystem: packagist (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| typo3/cms | packagist | All versions | 4.3.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-94Code InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
References
- https://nvd.nist.gov/vuln/detail/CVE-2010-1153ADVISORY
- https://github.com/TYPO3/typo3PACKAGE
- https://web.archive.org/web/20100813082506/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008WEB
- https://marc.info/?l=oss-security&m=127092306209177&w=2WEB
- https://www.openwall.com/lists/oss-security/2010/04/12/1WEB
Frequently Asked Questions
- What is CVE-2010-1153?
- TYPO3 PHP remote file inclusion vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2010-1153?
- CVE-2010-1153 affects typo3/cms. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2010-1153 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2022-47406CRITICAL
TYPO3 vulnerable to Insufficient Session Expiration
- CVE-2011-4628CRITICAL
Typo3 Authentication Bypass
- CVE-2011-3583CRITICAL
Typo3 SQL injection due to faulty prepared statements
- CVE-2021-21355HIGH
Unrestricted File Upload in Form Framework
- CVE-2023-24814HIGH
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
- CVE-2026-65954HIGH
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
- CVE-2019-19849HIGH
TYPO3 Insecure Deserialization in Query Generator & Query View
- CVE-2018-14041MEDIUM
Bootstrap Cross-site Scripting vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies