Information disclosure in TYPO3

CVE-2014-3946

The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.

Vulnerability class: Information Disclosure

EPSS: 0.011 (62.8th percentile) — read the EPSS interpretation.

Affected products

Typo3 — versions 6.2, 6.2.0, 6.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (mailing-list, x_refsource_MLIST)