PT-2014-5484 · Typo3 · Si Bibtex Extension+1

Publicado 2014-05-16 · Atualizado 2018-10-09 · CVE-2014-3759

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 si bibtex extension version 0.2.3

Description The issue concerns SQL injection vulnerabilities in the search and list functionality of the si bibtex extension for TYPO3, allowing remote attackers to execute arbitrary SQL commands.

Recommendations For version 0.2.3, consider disabling the search and list functionality in the si bibtex extension until a patch is available. Restrict access to the si bibtex extension to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-3759

Produtos afetados

Typo3

Si Bibtex Extension

Referências · 5

• http://securityfocus.com/archive/1/531980/100/0/threaded · Nota
• http://securityfocus.com/bid/67145 · Nota
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140430-0_Typo3_si_bibtex_extension_SQL_injection_and_XSS_vulnerabilities_v10.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3759 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Apr/314 · Nota