PT-2014-5621 · Typo3+1 · Typo3+1

Helmut Hummel + 1 · Published 2014-06-03 · Updated 2022-05-14 · CVE-2014-3941

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.0 through 4.5.33 TYPO3 versions 4.7.0 through 4.7.18 TYPO3 versions 6.0.0 through 6.0.13 TYPO3 versions 6.1.0 through 6.1.8 TYPO3 versions 6.2.0 through 6.2.2

Description The issue allows remote attackers to have an unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

Recommendations For TYPO3 versions 4.5.0 through 4.5.33, update to version 4.5.34 or later. For TYPO3 versions 4.7.0 through 4.7.18, update to version 4.7.19 or later. For TYPO3 versions 6.0.0 through 6.0.13, update to version 6.0.14 or later. For TYPO3 versions 6.1.0 through 6.1.8, update to version 6.1.9 or later. For TYPO3 versions 6.2.0 through 6.2.2, update to version 6.2.3 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-644

Related Identifiers

CVE-2014-3941

DSA-2942-1

GHSA-594H-CX6W-P4JF

GHSA-M2JH-FXW4-GPHM

OPENSUSE-SU-2016_2025-1

Affected Products

Suse

Typo3

References · 20

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41114.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3941.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41114.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-m2jh-fxw4-gphm · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html · Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html · Vendor Advisory
• http://debian.org/security/2014/dsa-2942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3941 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41114 · Security Note
• https://osv.dev/vulnerability/GHSA-594h-cx6w-p4jf · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/5cbff85506cebe343e5ae59228977547cf8e3cf4 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-m2jh-fxw4-gphm · Note