CVE-2014-3946 Typo3 Information Disclosure
MediumCVSS 4.0
EPSS 1.1%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3/cms(Packagist) | >= 6.2.0, < 6.2.3 | 6.2.3 |
| typo3/cms(Packagist) | = 6.2.0 | No fix listed |
| typo3/cms(Packagist) | = 6.2.1 | No fix listed |
| typo3/cms(Packagist) | = 6.2.2 | No fix listed |
| typo3 | = 6.2 | No fix listed |
| typo3 | = 6.2.0-beta1 | No fix listed |
| typo3 | = 6.2.0-beta2 | No fix listed |
| typo3 | = 6.2.0-beta3 | No fix listed |
| typo3 | = 6.2.1 | No fix listed |
| typo3 | = 6.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com product
- typo3.org
- typo3.org
- DSA-2942 vendor-advisory
- [oss-security] 20140603 Re: CVE ID request: typo3 mailing-list
- typo3.org vendor-advisory
- github.com