---
title: Insecure Unserialize Vulnerability in FLOW3
url: "https://news.typo3.com/article/flow3-sa-2012-001"
description: It has been discovered that FLOW3 is vulnerable to Insecure Unserialize
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
---

# Insecure Unserialize Vulnerability in FLOW3

Insecure Unserialize Vulnerability in FLOW3
===========================================

28 March 2012

It has been discovered that FLOW3 is vulnerable to Insecure Unserialize

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

**Component Type:** FLOW3

**Affected Versions:** 1.0, master

Release Date: March 28, 2012

**Vulnerability Type:** Insecure unserialize

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C%29&g=3&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Problem Description:** Due to a missing signature (HMAC) for a request argument, an attacker could unserialize arbitrary objects within FLOW3.
To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be exploitable objects within user applications.

**Solution:** Update to [FLOW3 1.0.4](http://news.typo3.org/news/article/flow3-104-has-been-released/) which fixes the problem described!

**Note:** The same problem applies to the Extbase Framework in TYPO3. Read the according [advisory TYPO3-CORE-SA-2012-001](http://typo3.org/teams/security/security-bulletins/flow3/typo3-flow3-sa-2012-001/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/ "Opens internal link in current window") for more information.

**Credits:** Credits go to Security Team Member Helmut Hummel who discovered and reported the issue.

 **General Advice:** Please subscribe to the FLOW3-announce mailing list.

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

[More posts by this author](https://news.typo3.com/article/author/marcus-krause)