PT-2014-5626 · Typo3 · Typo3+1

Jan Kiesewetter · Published 2014-06-03 · Updated 2022-05-17 · CVE-2014-3946

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 6.2.0 through 6.2.2

Description The query caching functionality in the Extbase Framework component does not properly validate group permissions, allowing remote authenticated users to read arbitrary queries. This issue is related to the failure to respect user groups of logged-in users when caching queries, which can lead to information disclosure. The query caching, introduced in Extbase 6.2, can present query results for a specific user group to a different group.

Recommendations For TYPO3 versions 6.2.0 through 6.2.2, update to version 6.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the query caching functionality in the Extbase Framework component until a patch is available. Restrict access to sensitive queries to minimize the risk of information disclosure.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3946

DSA-2942-1

GHSA-VCCP-5V5H-P8M6

Affected Products

Extbase Framework

Typo3

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3946.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-vccp-5v5h-p8m6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3946 · Security Note
• http://debian.org/security/2014/dsa-2942 · Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• http://openwall.com/lists/oss-security/2014/06/03/2 · Note
• https://typo3.org/security/advisory/typo3-core-sa-2014-001 · Note
• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Note