PT-2014-8472 · Typo3 · Fal Sftp Extension

Published 2014-10-27 · Updated 2022-05-17 · CVE-2014-8327

Positive Technologies (AI Summary)

CVSS v4.0

4.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions TYPO3 fal sftp extension versions prior to 0.2.6

Description The issue allows remote authenticated users to obtain sensitive information due to weak permissions for sFTP driver files and folders.

Recommendations For versions prior to 0.2.6, update the fal sftp extension to version 0.2.6 or later to resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2014-8327

GHSA-XWQ4-2CWR-FV2Q

Affected Products

Fal Sftp Extension

References · 6

• http://typo3.org/extensions/repository/view/fal_sftp · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-8327 · Security Note
• https://osv.dev/vulnerability/GHSA-xwq4-2cwr-fv2q · Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-014 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97668 · Note
• https://typo3.org/security/advisory/typo3-ext-sa-2014-014 · Note