Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2021-43564: Job Fair extension for TYPO3 fails to secure uploaded file names
CVE-2021-43564 · published 4 years ago
Summary
The Job Fair extension for TYPO3 doesn't protect the names of files uploaded to your website, making it possible for anyone to guess and download sensitive files. This could expose confidential information. To fix this issue, update to the latest version of the Job Fair extension (1.0.13 or 2.0.2 or higher).
What to do
- Update hov jobfair to version 1.0.13.
- Update hov jobfair to version 2.0.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | hov | jobfair |
< 1.0.13 >= 2.0.0, < 2.0.2 Fix: upgrade to 1.0.13
|
| – | job_fair_project | job_fair |
< 1.0.13 >= 2.0.0, < 2.0.2 cpe:2.3:a:job_fair_project:job_fair:*:*:*:*:*:typo3:*:* |
Original advisory text
An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows un...
An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published10 Nov 2021
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta