Advisory details:
gitlab / packagist/typo3/cms/CVE-2014-9508
| Advisory ID | gitlab/packagist/typo3/cms/CVE-2014-9508 |
| Aliases |
CVE-2014-9508
GHSA-v6xv-rmqc-wcc8 |
| Summary | Improper Link Resolution Before File Access ('Link Following') The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms/CVE-2014-9508.yml |
| Reference id | Reference type | URL |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html | ||
| http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/ | ||
| CVE-2014-9508 | https://nvd.nist.gov/vuln/detail/CVE-2014-9508 | |
| GHSA-v6xv-rmqc-wcc8 | https://github.com/advisories/GHSA-v6xv-rmqc-wcc8 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
There are no SSVC decisions available.