« Volver al listado

CVE-2014-8328

Estado: ModificadaMedia (5.3)—

The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dynamic Content Elements Project — Dynamic Content Elements

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-8328",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-03T14:15:10.553",
  "references": [
    {
      "url": "http://typo3.org/extensions/repository/view/dce",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/97673",
      "tags": [
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://typo3.org/extensions/repository/view/dce",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/97673",
      "tags": [
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request."
    },
    {
      "lang": "es",
      "value": "La configuración predeterminada en la extensión Dynamic Content Elements (dce) versiones anteriores a 0.11.5 para TYPO3, permite a atacantes remotos obtener información confidencial del entorno de instalación mediante la lectura de la petición de comprobación de actualización."
    }
  ],
  "lastModified": "2026-06-17T00:16:34.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dynamic_content_elements_project:dynamic_content_elements:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3F4314D-F051-49FE-A8F9-7AFE61B78498",
              "versionEndIncluding": "0.7.5",
              "versionStartIncluding": "0.7.0"
            },
            {
              "criteria": "cpe:2.3:a:dynamic_content_elements_project:dynamic_content_elements:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD9E0D2A-A514-4C10-8C49-A4351D983B3F",
              "versionEndIncluding": "0.8.6",
              "versionStartIncluding": "0.8.0"
            },
            {
              "criteria": "cpe:2.3:a:dynamic_content_elements_project:dynamic_content_elements:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACA17C63-45D4-4269-8C60-F0DDD8C2DB78",
              "versionEndIncluding": "0.9.4",
              "versionStartIncluding": "0.9.0"
            },
            {
              "criteria": "cpe:2.3:a:dynamic_content_elements_project:dynamic_content_elements:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFC8C166-4E2C-42E0-85AC-5C313B234D1F",
              "versionEndIncluding": "0.10.2",
              "versionStartIncluding": "0.10.0"
            },
            {
              "criteria": "cpe:2.3:a:dynamic_content_elements_project:dynamic_content_elements:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85F3F213-C842-4FE4-990A-2C14120E359B",
              "versionEndExcluding": "0.11.5",
              "versionStartIncluding": "0.11.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}