GitHub Advisoryadvisory · Packagist

GHSA-xwq4-2cwr-fv2q fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders

MEDIUM Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2014-8327
Ecosystem
Packagist
Packages
co-stack/fal_sftp, vertexvaar/falsftp
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-276
Reviewed
2025-04-14

Affected packages

• Packagist co-stack/fal_sftp: < 0.2.6 → fixed in 0.2.6 • Packagist vertexvaar/falsftp: < 0.2.6 → fixed in 0.2.6

Description

The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2014-8327 The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References