Search for vulnerabilities
Vulnerability details: VCID-ch74-1wa3-2bf5
Vulnerability ID VCID-ch74-1wa3-2bf5
Aliases CVE-2014-9508
GHSA-v6xv-rmqc-wcc8
Summary Typo3 Open Redirect In Frontend Rendering The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option `config.prefixLocalAnchors` is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri. Installations where `config.absRefPrefix` is additionally set to any value are not affected by this vulnerability. Example of affected configuration: ```php config.absRefPrefix = config.prefixLocalAnchors = all page = PAGE page.10 = TEXT page.10.value = <a href="#skiplinks">Skiplinks</a> .htaccess: RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-l RewriteRule .* index.php [L] ```
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
epss 0.00289 https://api.first.org/data/v1/epss?cve=CVE-2014-9508
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-9508.yaml
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2014-9508
generic_textual MODERATE https://typo3.org/security/advisory/typo3-core-sa-2014-003
generic_textual MODERATE http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003
Reference id Reference type URL
http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html
https://api.first.org/data/v1/epss?cve=CVE-2014-9508
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-9508.yaml
https://nvd.nist.gov/vuln/detail/CVE-2014-9508
https://typo3.org/security/advisory/typo3-core-sa-2014-003
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/
GHSA-v6xv-rmqc-wcc8 https://github.com/advisories/GHSA-v6xv-rmqc-wcc8
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.51938
EPSS Score 0.00289
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:26:36.829614+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-v6xv-rmqc-wcc8/GHSA-v6xv-rmqc-wcc8.json 36.1.3