PT-2014-7109 · Typo3+1 · Typo3+1

Published 2014-09-11 · Updated 2017-09-08 · CVE-2014-6236

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LumoNet PHP Include (lumophpinclude) extension versions prior to 1.2.1 for TYPO3

Description The issue allows remote attackers to execute arbitrary scripts. This is related to vectors involving extension links.

Recommendations For LumoNet PHP Include (lumophpinclude) extension versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2014-6236

Affected Products

Lumonet Php Include

Typo3

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-6236 · Security Note
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-010 · Vendor Advisory
• http://typo3.org/extensions/repository/view/lumophpinclude · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95707 · Note
• http://securityfocus.com/bid/69569 · Note
• http://secunia.com/advisories/60873 · Note