PT-2014-5626 · Typo3 · Typo3+1

Jan Kiesewetter · Publicado 2014-06-03 · Atualizado 2022-05-17 · CVE-2014-3946

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 6.2.0 through 6.2.2

Description The query caching functionality in the Extbase Framework component does not properly validate group permissions, allowing remote authenticated users to read arbitrary queries. This issue is related to the failure to respect user groups of logged-in users when caching queries, which can lead to information disclosure. The query caching, introduced in Extbase 6.2, can present query results for a specific user group to a different group.

Recommendations For TYPO3 versions 6.2.0 through 6.2.2, update to version 6.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the query caching functionality in the Extbase Framework component until a patch is available. Restrict access to sensitive queries to minimize the risk of information disclosure.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3946

DSA-2942-1

GHSA-VCCP-5V5H-P8M6

Produtos afetados

Extbase Framework

Typo3

Referências · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3946.yaml · Exploit
• https://github.com/TYPO3/typo3 · Nota
• https://osv.dev/vulnerability/GHSA-vccp-5v5h-p8m6 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/06/03/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3946 · Nota de Segurança
• http://debian.org/security/2014/dsa-2942 · Aviso do Fabricante
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Aviso do Fabricante
• https://typo3.org/security/advisory/typo3-core-sa-2014-001 · Nota
• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Nota