CVE-2014-9508
Last modified
CVE-2014-9508 is a vulnerability of currently unknown severity. The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.. EPSS estimates a 1.72% chance of exploitation in the next 30 days.
Description
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Typo3 | Typo3 | 4.5.0 | — |
| Typo3 | Typo3 | 4.5.1 | — |
| Typo3 | Typo3 | 4.5.2 | — |
| Typo3 | Typo3 | 4.5.3 | — |
| Typo3 | Typo3 | 4.5.4 | — |
| Typo3 | Typo3 | 4.5.5 | — |
| Typo3 | Typo3 | 4.5.6 | — |
| Typo3 | Typo3 | 4.5.7 | — |
| Typo3 | Typo3 | 4.5.8 | — |
| Typo3 | Typo3 | 4.5.9 | — |
| Typo3 | Typo3 | 4.5.10 | — |
| Typo3 | Typo3 | 4.5.11 | — |
| Typo3 | Typo3 | 4.5.12 | — |
| Typo3 | Typo3 | 4.5.13 | — |
| Typo3 | Typo3 | 4.5.14 | — |
| Typo3 | Typo3 | 4.5.15 | — |
| Typo3 | Typo3 | 4.5.16 | — |
| Typo3 | Typo3 | 4.5.17 | — |
| Typo3 | Typo3 | 4.5.18 | — |
| Typo3 | Typo3 | 4.5.19 | — |
| Typo3 | Typo3 | 4.5.20 | — |
| Typo3 | Typo3 | 4.5.21 | — |
| Typo3 | Typo3 | 4.5.22 | — |
| Typo3 | Typo3 | 4.5.23 | — |
| Typo3 | Typo3 | 4.5.24 | — |
| Typo3 | Typo3 | 4.5.25 | — |
| Typo3 | Typo3 | 4.5.26 | — |
| Typo3 | Typo3 | 4.5.27 | — |
| Typo3 | Typo3 | 4.5.28 | — |
| Typo3 | Typo3 | 4.5.29 | — |
| Typo3 | Typo3 | 4.5.30 | — |
| Typo3 | Typo3 | 4.5.31 | — |
| Typo3 | Typo3 | 4.5.32 | — |
| Typo3 | Typo3 | 4.5.33 | — |
| Typo3 | Typo3 | 4.5.34 | — |
| Typo3 | Typo3 | 4.5.35 | — |
| Typo3 | Typo3 | 4.5.36 | — |
| Typo3 | Typo3 | 4.5.37 | — |
| Typo3 | Typo3 | 4.5.38 | — |
| Typo3 | Typo3 | 4.6.0 | — |
| Typo3 | Typo3 | 4.6.1 | — |
| Typo3 | Typo3 | 4.6.2 | — |
| Typo3 | Typo3 | 4.6.3 | — |
| Typo3 | Typo3 | 4.6.4 | — |
| Typo3 | Typo3 | 4.6.5 | — |
| Typo3 | Typo3 | 4.6.6 | — |
| Typo3 | Typo3 | 4.6.7 | — |
| Typo3 | Typo3 | 4.6.8 | — |
| Typo3 | Typo3 | 4.6.9 | — |
| Typo3 | Typo3 | 4.6.10 | — |
Showing 50 of 116 affected configurations. See NVD for the full list.
References
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/Exploit, Vendor Advisory
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-9508?
How severe is CVE-2014-9508?
How do I fix CVE-2014-9508?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-9502Multiple cross-site request forgery (CSRF) vulnerabilities i…
- CVE-2014-9503The Discussions sub module in the Open Atrium module 7.x-2.x…
- CVE-2014-9504The OG Subgroups module, when used with the Open Atrium modu…
- CVE-2014-9505Cross-site scripting (XSS) vulnerability in the School Admin…
- CVE-2014-9506MantisBT before 1.2.18 does not properly check permissions w…
- CVE-2014-9507MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1…
- CVE-2014-9509The frontend rendering component in TYPO3 4.5.x before 4.5.3…
- CVE-2014-9510Cross-site request forgery (CSRF) vulnerability in the admin…
- CVE-2014-9512rsync 3.1.1 allows remote attackers to write to arbitrary fi…
- CVE-2014-9513Insecure use of temporary files in xbindkeys-config 0.1.3-2 …
- CVE-2014-9514Cross-site scripting (XSS) vulnerability in BMC Footprints S…
- CVE-2014-9515Dozer improperly uses a reflection-based approach to type co…9.8
Are you affected by CVE-2014-9508?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST