{"id":"CVE-2016-5091","details":"Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.","aliases":["GHSA-jxg5-35fj-ccwf"],"modified":"2026-08-27T08:18:25.263066Z","published":"2017-01-23T21:59:01.610Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/05/25/4"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/05/26/2"},{"type":"FIX","url":"https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/TYPO3/typo3","events":[{"introduced":"0"},{"last_affected":"35858f8f3ca041b40d21e917365b182f28ff88c4"},{"introduced":"583c888de32e077111951cced1a33571516cb5d3"},{"last_affected":"0833baed1fedfc868c64330fc8dc348b8c07ce02"}],"database_specific":{"cpe":["cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.1.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.3.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.3.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.5.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"6.2.23"},{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.0.2"},{"last_affected":"7.0.2"},{"introduced":"7.1.0"},{"last_affected":"7.1.0"},{"introduced":"7.2.0"},{"last_affected":"7.2.0"},{"introduced":"7.3.0"},{"last_affected":"7.3.0"},{"introduced":"7.3.1"},{"last_affected":"7.3.1"},{"introduced":"7.4.0"},{"last_affected":"7.4.0"},{"introduced":"7.5.0"},{"last_affected":"7.5.0"},{"introduced":"7.6.0"},{"last_affected":"7.6.0"},{"introduced":"7.6.1"},{"last_affected":"7.6.1"},{"introduced":"7.6.2"},{"last_affected":"7.6.2"},{"introduced":"7.6.3"},{"last_affected":"7.6.3"},{"introduced":"7.6.4"},{"last_affected":"7.6.4"},{"introduced":"7.6.5"},{"last_affected":"7.6.5"},{"introduced":"7.6.6"},{"last_affected":"7.6.6"},{"introduced":"7.6.7"},{"last_affected":"7.6.7"},{"introduced":"7.6.8"},{"last_affected":"7.6.8"},{"introduced":"8.1.1"},{"last_affected":"8.1.1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["7.0.0","7.0.2","7.1.0","7.2.0","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.6.8","8.1.1","TYPO3_8-1-1","TYPO3_8-1-0","8.1.0","TYPO3_6-2-23","6.2.23","TYPO3_6-2-22","6.2.22","TYPO3_6-2-21","6.2.21","TYPO3_6-2-20","6.2.20","TYPO3_8-0-0","8.0.0","TYPO3_6-2-19","6.2.19","TYPO3_6-2-18","6.2.18","TYPO3_7-6-2","TYPO3_6-2-17","6.2.17","TYPO3_7-6-1","TYPO3_6-2-16","6.2.16","TYPO3_7-6-0","TYPO3_7-5-0","TYPO3_6-2-15","6.2.15","TYPO3_7-4-0","TYPO3_6-2-14","6.2.14","TYPO3_7-3-0","TYPO3_6-2-13","6.2.13","TYPO3_7-2-0","TYPO3_6-2-12","6.2.12","TYPO3_6-2-11","6.2.11","TYPO3_6-2-10","6.2.10","TYPO3_7-1-0","TYPO3_6-2-10rc1","6.2.10-rc1","TYPO3_6-2-9","6.2.9","TYPO3_6-2-8","6.2.8","TYPO3_7-0-0","TYPO3_6-2-7","6.2.7","TYPO3_6-2-6","6.2.6","TYPO3_6-2-5","6.2.5","TYPO3_6-2-4","6.2.4","TYPO3_6-2-3","6.2.3","TYPO3_6-2-2","6.2.2","TYPO3_6-2-1","6.2.1","TYPO3_6-2-0","6.2.0","TYPO3_6-2-0rc2","TYPO3_6-2-0rc1","TYPO3_6-2-0beta7","TYPO3_6-2-0beta6","TYPO3_6-2-0beta5","TYPO3_6-2-0beta4","TYPO3_6-2-0beta3","TYPO3_6-2-0beta2","TYPO3_6-2-0beta1","TYPO3_6-2-0alpha3","TYPO3_6-2-0alpha2","TYPO3_6-2-0alpha1","TYPO3_6-1-0rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5091.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/benjaminkott/bootstrap_package","events":[{"introduced":"2bc505c5e22c84371390d6b9969da0e437094e93"},{"last_affected":"fe9f029bdc791fab9ac1c6fbf5f721522b961a10"}],"database_specific":{"cpe":["cpe:2.3:a:typo3:typo3:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.0.2"},{"last_affected":"7.0.2"},{"introduced":"7.1.0"},{"last_affected":"7.1.0"}],"source":"CPE_STRING"}}],"versions":["7.0.0","7.0.2","7.1.0","v7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5091.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/typo3/typo3","events":[{"introduced":"0"},{"last_affected":"35858f8f3ca041b40d21e917365b182f28ff88c4"},{"introduced":"583c888de32e077111951cced1a33571516cb5d3"},{"last_affected":"0833baed1fedfc868c64330fc8dc348b8c07ce02"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"6.2.23"},{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.0.2"},{"last_affected":"7.0.2"},{"introduced":"7.1.0"},{"last_affected":"7.1.0"},{"introduced":"7.2.0"},{"last_affected":"7.2.0"},{"introduced":"7.3.0"},{"last_affected":"7.3.0"},{"introduced":"7.3.1"},{"last_affected":"7.3.1"},{"introduced":"7.4.0"},{"last_affected":"7.4.0"},{"introduced":"7.5.0"},{"last_affected":"7.5.0"},{"introduced":"7.6.0"},{"last_affected":"7.6.0"},{"introduced":"7.6.1"},{"last_affected":"7.6.1"},{"introduced":"7.6.2"},{"last_affected":"7.6.2"},{"introduced":"7.6.3"},{"last_affected":"7.6.3"},{"introduced":"7.6.4"},{"last_affected":"7.6.4"},{"introduced":"7.6.5"},{"last_affected":"7.6.5"},{"introduced":"7.6.6"},{"last_affected":"7.6.6"},{"introduced":"7.6.7"},{"last_affected":"7.6.7"},{"introduced":"7.6.8"},{"last_affected":"7.6.8"},{"introduced":"8.1.1"},{"last_affected":"8.1.1"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.1.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.3.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.3.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.5.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*"]}}],"versions":["7.0.0","7.0.2","7.1.0","7.2.0","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.6.8","8.1.1","TYPO3_8-1-1","TYPO3_8-1-0","8.1.0","TYPO3_6-2-23","6.2.23","TYPO3_6-2-22","6.2.22","TYPO3_6-2-21","6.2.21","TYPO3_6-2-20","6.2.20","TYPO3_8-0-0","8.0.0","TYPO3_6-2-19","6.2.19","TYPO3_6-2-18","6.2.18","TYPO3_7-6-2","TYPO3_6-2-17","6.2.17","TYPO3_7-6-1","TYPO3_6-2-16","6.2.16","TYPO3_7-6-0","TYPO3_7-5-0","TYPO3_6-2-15","6.2.15","TYPO3_7-4-0","TYPO3_6-2-14","6.2.14","TYPO3_7-3-0","TYPO3_6-2-13","6.2.13","TYPO3_7-2-0","TYPO3_6-2-12","6.2.12","TYPO3_6-2-11","6.2.11","TYPO3_6-2-10","6.2.10","TYPO3_7-1-0","TYPO3_6-2-10rc1","6.2.10-rc1","TYPO3_6-2-9","6.2.9","TYPO3_6-2-8","6.2.8","TYPO3_7-0-0","TYPO3_6-2-7","6.2.7","TYPO3_6-2-6","6.2.6","TYPO3_6-2-5","6.2.5","TYPO3_6-2-4","6.2.4","TYPO3_6-2-3","6.2.3","TYPO3_6-2-2","6.2.2","TYPO3_6-2-1","6.2.1","TYPO3_6-2-0","6.2.0","TYPO3_6-2-0rc2","TYPO3_6-2-0rc1","TYPO3_6-2-0beta7","TYPO3_6-2-0beta6","TYPO3_6-2-0beta5","TYPO3_6-2-0beta4","TYPO3_6-2-0beta3","TYPO3_6-2-0beta2","TYPO3_6-2-0beta1","TYPO3_6-2-0alpha3","TYPO3_6-2-0alpha2","TYPO3_6-2-0alpha1","TYPO3_6-1-0rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5091.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}