PT-2014-5621 · Typo3+1 · Typo3+1

Helmut Hummel + 1 · Publicado 2014-06-03 · Atualizado 2022-05-14 · CVE-2014-3941

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.0 through 4.5.33 TYPO3 versions 4.7.0 through 4.7.18 TYPO3 versions 6.0.0 through 6.0.13 TYPO3 versions 6.1.0 through 6.1.8 TYPO3 versions 6.2.0 through 6.2.2

Description The issue allows remote attackers to have an unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

Recommendations For TYPO3 versions 4.5.0 through 4.5.33, update to version 4.5.34 or later. For TYPO3 versions 4.7.0 through 4.7.18, update to version 4.7.19 or later. For TYPO3 versions 6.0.0 through 6.0.13, update to version 6.0.14 or later. For TYPO3 versions 6.1.0 through 6.1.8, update to version 6.1.9 or later. For TYPO3 versions 6.2.0 through 6.2.2, update to version 6.2.3 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-644

Identificadores relacionados

CVE-2014-3941

DSA-2942-1

GHSA-594H-CX6W-P4JF

GHSA-M2JH-FXW4-GPHM

OPENSUSE-SU-2016_2025-1

Produtos afetados

Suse

Typo3

Referências · 20

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41114.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3941.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41114.yaml · Exploit
• https://github.com/TYPO3/typo3 · Nota
• https://github.com/TYPO3/typo3/commit/5cbff85506cebe343e5ae59228977547cf8e3cf4 · Nota
• https://github.com/TYPO3/typo3/security/advisories/GHSA-m2jh-fxw4-gphm · Nota
• https://osv.dev/vulnerability/GHSA-m2jh-fxw4-gphm · Aviso do Fabricante
• https://typo3.org/security/advisory/typo3-core-sa-2021-015 · Nota
• http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/06/03/2 · Nota
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html · Aviso do Fabricante
• http://debian.org/security/2014/dsa-2942 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3941 · Nota de Segurança