GitHub Advisoryadvisory · Packagist
GHSA-v4vm-gj2x-6qhm DCE extension for Typo3 Discloses Environment Information
MEDIUM
Official page ↗
- Aliases
- CVE-2014-8328
- Ecosystem
- Packagist
- Packages
- t3/dce
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2023-08-15
Affected packages
• Packagist t3/dce: < 0.11.5 → fixed in 0.11.5
Description
The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request.
Related
Alias · CVE (1)
- CVE-2014-8328 The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-8328 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97673 web
- https://github.com/a-r-m-i-n/dce package
- http://typo3.org/extensions/repository/view/dce web
- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015 web