A regression, introduced during TYPO3 v11 development, led to this situation. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 is an open source PHP based web content management system released under the GNU GPL.

Version 21.3 was officially de-supported by the end of 2020. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. This is fixed in all recent versions, such as version 26. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. ** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It is also possible to modify the emails of other users, through a misconfiguration of the username parameter, on the user profile page. This allows a malicious user to modify all users' profiles, to elevate any privileges to administrative ones, or to create or delete any type of user. Specifically, it was found that any authenticated user can reach the administrative console for user management by directly requesting access to the page via URL. By not verifying the permissions for access to resources, it allows a potential attacker to view pages that are not allowed. ** UNSUPPORTED WHEN ASSIGNED ** ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw.

In this way, if HTML code or client-side executable code (e.g., Javascript) is entered as input, the expected execution flow could be altered. ** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/ because the data received as input from clients is re-included within the HTTP response returned by the application without adequate validation. Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.

Iexplorer registration code 4.2.6