CVEvulnerability
CVE-2014-9509
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-01-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page.
Affected configurations
• typo3 typo3 4.5.0
• typo3 typo3 4.5.1
• typo3 typo3 4.5.2
• typo3 typo3 4.5.3
• typo3 typo3 4.5.4
• typo3 typo3 4.5.5
• typo3 typo3 4.5.6
• typo3 typo3 4.5.7
• typo3 typo3 4.5.8
• typo3 typo3 4.5.9
• typo3 typo3 4.5.10
• typo3 typo3 4.5.11
• typo3 typo3 4.5.12
• typo3 typo3 4.5.13
• typo3 typo3 4.5.14
• typo3 typo3 4.5.15
• typo3 typo3 4.5.16
• typo3 typo3 4.5.17
• typo3 typo3 4.5.18
• typo3 typo3 4.5.19
• typo3 typo3 4.5.20
• typo3 typo3 4.5.21
• typo3 typo3 4.5.22
• typo3 typo3 4.5.23
• typo3 typo3 4.5.24
• typo3 typo3 4.5.25
• typo3 typo3 4.5.26
• typo3 typo3 4.5.27
• typo3 typo3 4.5.28
• typo3 typo3 4.5.29
• typo3 typo3 4.5.30
• typo3 typo3 4.5.31
• typo3 typo3 4.5.32
• typo3 typo3 4.5.33
• typo3 typo3 4.5.34
• typo3 typo3 4.5.35
• typo3 typo3 4.5.36
• typo3 typo3 4.5.37
• typo3 typo3 4.5.38
• typo3 typo3 4.6.0
• typo3 typo3 4.6.1
• typo3 typo3 4.6.2
• typo3 typo3 4.6.3
• typo3 typo3 4.6.4
• typo3 typo3 4.6.5
• typo3 typo3 4.6.6
• typo3 typo3 4.6.7
• typo3 typo3 4.6.8
• typo3 typo3 4.6.9
• typo3 typo3 4.6.10
• typo3 typo3 4.6.11
• typo3 typo3 4.6.12
• typo3 typo3 4.6.13
• typo3 typo3 4.6.14
• typo3 typo3 4.6.15
• typo3 typo3 4.6.16
• typo3 typo3 4.6.17
• typo3 typo3 4.6.18
• typo3 typo3 4.7.0
• typo3 typo3 4.7.1
… and 56 more
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/ Exploit, Vendor Advisory
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/ Exploit, Vendor Advisory