PT-2014-8472 · Typo3 · Fal Sftp Extension

Publicado 2014-10-27 · Atualizado 2022-05-17 · CVE-2014-8327

Positive Technologies (AI Summary)

CVSS v4.0

4.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions TYPO3 fal sftp extension versions prior to 0.2.6

Description The issue allows remote authenticated users to obtain sensitive information due to weak permissions for sFTP driver files and folders.

Recommendations For versions prior to 0.2.6, update the fal sftp extension to version 0.2.6 or later to resolve the issue.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2014-8327

GHSA-XWQ4-2CWR-FV2Q

Produtos afetados

Fal Sftp Extension

Referências · 6

• http://typo3.org/extensions/repository/view/fal_sftp · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2014-8327 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xwq4-2cwr-fv2q · Aviso do Fabricante
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-014 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97668 · Nota
• https://typo3.org/security/advisory/typo3-ext-sa-2014-014 · Nota