« Volver al listado

CVE-2026-77142

Estado: AplazadaAlta (8.8)—

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso de red sin autenticación (AV:N, PR:N) a falla de validación en el servidor que permite sobrescribir datos de terceros. CWE-862 (autorización faltante) confirma manipulación de datos sin validación de propiedad.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementPassword PoliciesRemote Data StorageNetwork Segmentation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-77142",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77142",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-25T14:03:42.642471Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.8,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "affectedData": [
        {
          "vendor": "TYPO3",
          "product": "Extension \"Industry Directory\"",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0",
              "lessThan": "8.1.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "lessThan": "7.0.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.1.6",
              "versionType": "semver"
            }
          ],
          "packageName": "jweiland/yellowpages2",
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-25T09:17:35.133",
  "references": [
    {
      "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-020",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it."
    },
    {
      "lang": "es",
      "value": "La función de edición de autoservicio de la empresa en el frontend se basa en un indicador de visibilidad a nivel de plantilla para ocultar el formulario de edición de los registros de la empresa que un visitante no posee, pero la operación de escritura correspondiente no repite esta verificación de propiedad en el lado del servidor. Como resultado, un visitante que conoce el identificador de un registro de empresa del directorio público puede enviar directamente una solicitud de actualización modificada para ese registro y sobrescribir sus datos, sin que la aplicación confirme nunca que el visitante lo posee."
    }
  ],
  "lastModified": "2026-09-28T23:10:00.143",
  "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
}