VAR-201110-0216
Vulnerability from variot - Updated: 2025-04-11 20:05Unspecified vulnerability in the Drag Drop Mass Upload (ameos_dragndropupload) extension 2.0.2 and earlier for TYPO3 allows remote attackers to upload arbitrary files via unknown vectors. Typo3 is one of the leading brands of open source content management systems (CMS) and content management frameworks (CMF) based on PHP and MySQL databases and is a powerful open source solution. A remote attacker can update any file with an unknown vector. The issue occurs because the application fails to adequately validate user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201110-0216",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ameos dragndropupload",
"scope": "eq",
"trust": 1.6,
"vendor": "jerome schneider",
"version": "2.0.0"
},
{
"model": "ameos dragndropupload",
"scope": "eq",
"trust": 1.6,
"vendor": "jerome schneider",
"version": "2.0.1"
},
{
"model": "ameos dragndropupload",
"scope": "lte",
"trust": 1.0,
"vendor": "jerome schneider",
"version": "2.0.2"
},
{
"model": "drag drop mass upload",
"scope": "lte",
"trust": 0.8,
"vendor": "jerome schneider",
"version": "extension 2.0.2"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "no",
"version": null
},
{
"model": "ameos dragndropupload",
"scope": "eq",
"trust": 0.6,
"vendor": "jerome schneider",
"version": "2.0.2"
},
{
"model": "drag drop mass upload",
"scope": "eq",
"trust": 0.3,
"vendor": "typo3",
"version": "2.0.2"
},
{
"model": "drag drop mass upload",
"scope": "ne",
"trust": 0.3,
"vendor": "typo3",
"version": "3.1.1"
},
{
"model": "drag drop mass upload",
"scope": "ne",
"trust": 0.3,
"vendor": "typo3",
"version": "3.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ameos dragndropupload",
"version": "2.0.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ameos dragndropupload",
"version": "2.0.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ameos dragndropupload",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"db": "BID",
"id": "49516"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017"
},
{
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:jerome_schneider:ameos_dragndropupload",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Oliver Hader",
"sources": [
{
"db": "BID",
"id": "49516"
},
{
"db": "CNNVD",
"id": "CNNVD-201109-100"
}
],
"trust": 0.9
},
"cve": "CVE-2011-3980",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2011-3980",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-3980",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2011-6034",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "90994ef0-2354-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-3980",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-3980",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2011-6034",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201110-017",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017"
},
{
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unspecified vulnerability in the Drag Drop Mass Upload (ameos_dragndropupload) extension 2.0.2 and earlier for TYPO3 allows remote attackers to upload arbitrary files via unknown vectors. Typo3 is one of the leading brands of open source content management systems (CMS) and content management frameworks (CMF) based on PHP and MySQL databases and is a powerful open source solution. A remote attacker can update any file with an unknown vector. The issue occurs because the application fails to adequately validate user-supplied input. \nAn attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-3980"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"db": "BID",
"id": "49516"
},
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-3980",
"trust": 3.5
},
{
"db": "BID",
"id": "49516",
"trust": 3.1
},
{
"db": "CNVD",
"id": "CNVD-2011-6034",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201109-100",
"trust": 0.6
},
{
"db": "XF",
"id": "3",
"trust": 0.6
},
{
"db": "XF",
"id": "69694",
"trust": 0.6
},
{
"db": "IVD",
"id": "90994EF0-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"db": "BID",
"id": "49516"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"db": "CNNVD",
"id": "CNNVD-201109-100"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017"
},
{
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"id": "VAR-201110-0216",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-6034"
}
],
"trust": 0.08
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-6034"
}
]
},
"last_update_date": "2025-04-11T20:05:20.462000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "TYPO3-EXT-SA-2011-010: A vulnerability in extension Drag Drop Mass Upload (ameos_dragndropupload)",
"trust": 0.8,
"url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2011-010/"
},
{
"title": "TYPO3 Drag Drop Mass Upload Patch for any file update vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/36296"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://www.securityfocus.com/bid/49516"
},
{
"trust": 1.9,
"url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2011-010/"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69694"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3980"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-3980"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/69694"
},
{
"trust": 0.3,
"url": "http://typo3.com/"
},
{
"trust": 0.3,
"url": "http://typo3.org/extensions/repository/view/ameos_dragndropupload/3.1.1/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"db": "BID",
"id": "49516"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"db": "CNNVD",
"id": "CNNVD-201109-100"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017"
},
{
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"db": "BID",
"id": "49516"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"db": "CNNVD",
"id": "CNNVD-201109-100"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017"
},
{
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-09T00:00:00",
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"date": "2011-09-08T00:00:00",
"db": "BID",
"id": "49516"
},
{
"date": "2011-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"date": "1900-01-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201109-100"
},
{
"date": "2011-10-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201110-017"
},
{
"date": "2011-10-04T10:55:11.723000",
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-6034"
},
{
"date": "2011-10-05T16:00:00",
"db": "BID",
"id": "49516"
},
{
"date": "2011-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002338"
},
{
"date": "2011-09-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201109-100"
},
{
"date": "2011-10-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201110-017"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-3980"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201109-100"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TYPO3 Drag Drop Mass Upload Arbitrary File Update Vulnerability",
"sources": [
{
"db": "IVD",
"id": "90994ef0-2354-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-017"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201109-100"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…