How severe is CVE-2012-3527?

CVE-2012-3527 has a CVSS 2.0 base score of 4.6, rated medium severity.

Is CVE-2012-3527 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2012-3527?

CVE-2012-3527 primarily affects Typo3. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2012-3527?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2012-3527 published?

CVE-2012-3527 was published on 2012-09-05 and last updated on 2026-06-16.

CVE-2012-3527

CVE-2012-3527 is a medium-severity vulnerability in Typo3 with a CVSS 2.0 base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-502.

Key facts

Severity: Medium (CVSS 2.0 base score 4.6)
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-502
Affected product: Typo3
Published: 2012-09-05
Last modified: 2026-06-16

Description

view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."

Frequently asked questions

What is CVE-2012-3527?: view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
How severe is CVE-2012-3527?: CVE-2012-3527 has a CVSS 2.0 base score of 4.6, rated medium severity.
Is CVE-2012-3527 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2012-3527?: CVE-2012-3527 primarily affects Typo3. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2012-3527?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2012-3527 published?: CVE-2012-3527 was published on 2012-09-05 and last updated on 2026-06-16.

References

Affected products (3)

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

More vulnerabilities in Typo3

CVE-2009-0258 — Critical (CVSS 10.0): The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and…
CVE-2011-3583 — Critical (CVSS 9.8): It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not…
CVE-2011-4628 — Critical (CVSS 9.8): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication…
CVE-2025-59017 — High (CVSS 8.8): Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53,…
CVE-2023-24814 — High (CVSS 8.8): TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected…
CVE-2021-41113 — High (CVSS 8.8): TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that…

All CVEs affecting Typo3 →

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

CVE-2026-41104 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose…
CVE-2026-43633 — Critical (CVSS 10.0): HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a…
CVE-2026-33819 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131 — Critical (CVSS 10.0): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2026-25632 — Critical (CVSS 10.0): EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water…
CVE-2025-14931 — Critical (CVSS 10.0): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.…

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →