CVE-2021-43564

Published: Nov 10, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).

Affected (2)

Products: Job Fair Project: Job Fair

Job Fair Project

1 product

Job Fair

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Job Fair Project Job Fair	version < 1.0.13
Job Fair Project Job Fair	2.0.0 ≤ version < 2.0.2

References (2)

https://typo3.org/security/advisory/typo3-ext-sa-2021-018

Source: cve@mitre.org

PatchThird Party Advisory

https://typo3.org/security/advisory/typo3-ext-sa-2021-018

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.