PT-2014-5484 · Typo3 · Si Bibtex Extension+1

Published 2014-05-16 · Updated 2018-10-09 · CVE-2014-3759

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 si bibtex extension version 0.2.3

Description The issue concerns SQL injection vulnerabilities in the search and list functionality of the si bibtex extension for TYPO3, allowing remote attackers to execute arbitrary SQL commands.

Recommendations For version 0.2.3, consider disabling the search and list functionality in the si bibtex extension until a patch is available. Restrict access to the si bibtex extension to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-3759

Affected Products

Typo3

Si Bibtex Extension

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-3759 · Security Note
• http://securityfocus.com/archive/1/531980/100/0/threaded · Note
• http://securityfocus.com/bid/67145 · Note
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140430-0_Typo3_si_bibtex_extension_SQL_injection_and_XSS_vulnerabilities_v10.txt · Note
• http://seclists.org/fulldisclosure/2014/Apr/314 · Note