VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 23, 2013· Updated Apr 29, 2026

CVE-2013-7081

CVE-2013-7081

Description

TYPO3 Form Content Element allows authenticated editors to forge HMAC signatures, bypassing access restrictions in versions 4.5-6.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

TYPO3 Form Content Element allows authenticated editors to forge HMAC signatures, bypassing access restrictions in versions 4.5-6.1.

Vulnerability

The old Form Content Element component in TYPO3 versions 4.5.0 to 4.5.31, 4.7.0 to 4.7.16, 6.0.0 to 6.0.11, and 6.1.0 to 6.1.6 allows authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors [1][2][3]. The issue stems from failing to check user permissions when processing requests, enabling the forging of URL parameters [2].

Exploitation

An attacker must be an authenticated editor with access to the Form Content Element component. By crafting specific URL parameters, they can generate HMAC signatures that bypass access control checks [3]. No detailed exploit sequence is publicly available.

Impact

Successful exploitation allows the attacker to bypass access restrictions, potentially reading or modifying content from TYPO3 table columns that they are not authorized to access [2]. The impact is limited to authenticated editors, but could lead to information disclosure or unauthorized changes.

Mitigation

Upgrade to TYPO3 versions 4.5.32, 4.7.17, 6.0.12, or 6.1.7, which were released on December 10, 2013, and fix the vulnerability [1][2]. No workaround is available; updating is the recommended solution [2].

References
  1. oss-sec: CVE request: TYPO3-CORE-SA-2013-004 and TYPO3-FLOW-SA-2013-001
  2. Multiple Vulnerabilities in TYPO3 CMS
  3. NVD - CVE-2013-7081

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
typo3/cms-corePackagist
>= 4.5.0, < 4.5.314.5.31
typo3/cms-corePackagist
>= 4.7.0, < 4.7.164.7.16
typo3/cms-corePackagist
>= 6.0.0, < 6.0.116.0.11
typo3/cms-corePackagist
>= 6.1.0, < 6.1.66.1.6

Affected products

69
  • TYPO3/Typo368 versions
    cpe:2.3:a:typo3:typo3:4.5.0:*:*:*:*:*:*:*+ 67 more
    • cpe:2.3:a:typo3:typo3:4.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.10:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.11:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.12:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.13:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.14:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.15:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.16:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.17:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.18:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.19:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.20:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.21:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.22:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.23:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.24:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.25:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.26:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.27:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.28:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.29:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.30:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.31:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.8:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.5.9:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.11:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.12:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.13:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.14:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.15:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.16:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.7.9:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:6.1.6:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:composer/typo3/cms-core
    Range: >= 4.5.0, < 4.5.31

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.