GitHub Advisoryadvisory · Packagist
GHSA-vccp-5v5h-p8m6 Typo3 Information Disclosure
MEDIUM
Official page ↗
- Aliases
- CVE-2014-3946
- Ecosystem
- Packagist
- Packages
- typo3/cms
- Severity
- Moderate
- Weaknesses
- CWE-200
- Reviewed
- 2023-08-16
Affected packages
• Packagist typo3/cms: >= 6.2.0, < 6.2.3 → fixed in 6.2.3
Description
Failing to respect user groups of logged in users when caching queries, Extbase is susceptible to information disclosure. The query caching (introduced in Extbase 6.2) used to cache queries that query results for a specific user group were presented to a different group.
Related
Alias · CVE (1)
- CVE-2014-3946 The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3946 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-3946.yaml web
- https://github.com/TYPO3/typo3 package
- https://typo3.org/security/advisory/typo3-core-sa-2014-001 web
- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 web
- http://www.debian.org/security/2014/dsa-2942 web
- http://www.openwall.com/lists/oss-security/2014/06/03/2 web