CVEvulnerability
CVE-2014-3946
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-06-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.
Affected configurations
• typo3 typo3 6.2
• typo3 typo3 6.2.0
• typo3 typo3 6.2.1
• typo3 typo3 6.2.2
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ Vendor Advisory
- http://www.debian.org/security/2014/dsa-2942 www.debian.org
- http://www.openwall.com/lists/oss-security/2014/06/03/2 www.openwall.com
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ Vendor Advisory
- http://www.debian.org/security/2014/dsa-2942 www.debian.org
- http://www.openwall.com/lists/oss-security/2014/06/03/2 www.openwall.com