« Volver al listado

CVE-2014-3946

Estado: ModificadaMedia (4)—

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Typo3 — Typo3

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3946",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-06-03T14:55:11.287",
  "references": [
    {
      "url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2942",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/06/03/2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2942",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/06/03/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de cacheo de consulta en el componente Extbase Framework en TYPO3 6.2.0 anterior a 6.2.3 no valida debidamente permisos de grupo, lo que permite a usuarios remotos autenticados leer consultas arbitrarias a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:09:11.187",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:typo3:typo3:6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7715060-1441-4CF9-BEDF-91D28FE31ECC"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:6.2.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7183456A-52B4-4386-8979-A2ECEA9959FE"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:6.2.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16EEC79F-3293-451C-864E-9CE020F6C730"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:6.2.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FD27EAD-04D5-4C55-952E-020954B90CEF"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:6.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99262E73-E4A7-4657-A32E-3C289C052675"
            },
            {
              "criteria": "cpe:2.3:a:typo3:typo3:6.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E230A800-B2DE-4ED4-9C6B-961832C39900"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}