CVE-2014-9509
Last modified
CVE-2014-9509 is a vulnerability of currently unknown severity. The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page.. EPSS estimates a 1.50% chance of exploitation in the next 30 days.
Description
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Typo3 | Typo3 | 4.5.0 | — |
| Typo3 | Typo3 | 4.5.1 | — |
| Typo3 | Typo3 | 4.5.2 | — |
| Typo3 | Typo3 | 4.5.3 | — |
| Typo3 | Typo3 | 4.5.4 | — |
| Typo3 | Typo3 | 4.5.5 | — |
| Typo3 | Typo3 | 4.5.6 | — |
| Typo3 | Typo3 | 4.5.7 | — |
| Typo3 | Typo3 | 4.5.8 | — |
| Typo3 | Typo3 | 4.5.9 | — |
| Typo3 | Typo3 | 4.5.10 | — |
| Typo3 | Typo3 | 4.5.11 | — |
| Typo3 | Typo3 | 4.5.12 | — |
| Typo3 | Typo3 | 4.5.13 | — |
| Typo3 | Typo3 | 4.5.14 | — |
| Typo3 | Typo3 | 4.5.15 | — |
| Typo3 | Typo3 | 4.5.16 | — |
| Typo3 | Typo3 | 4.5.17 | — |
| Typo3 | Typo3 | 4.5.18 | — |
| Typo3 | Typo3 | 4.5.19 | — |
| Typo3 | Typo3 | 4.5.20 | — |
| Typo3 | Typo3 | 4.5.21 | — |
| Typo3 | Typo3 | 4.5.22 | — |
| Typo3 | Typo3 | 4.5.23 | — |
| Typo3 | Typo3 | 4.5.24 | — |
| Typo3 | Typo3 | 4.5.25 | — |
| Typo3 | Typo3 | 4.5.26 | — |
| Typo3 | Typo3 | 4.5.27 | — |
| Typo3 | Typo3 | 4.5.28 | — |
| Typo3 | Typo3 | 4.5.29 | — |
| Typo3 | Typo3 | 4.5.30 | — |
| Typo3 | Typo3 | 4.5.31 | — |
| Typo3 | Typo3 | 4.5.32 | — |
| Typo3 | Typo3 | 4.5.33 | — |
| Typo3 | Typo3 | 4.5.34 | — |
| Typo3 | Typo3 | 4.5.35 | — |
| Typo3 | Typo3 | 4.5.36 | — |
| Typo3 | Typo3 | 4.5.37 | — |
| Typo3 | Typo3 | 4.5.38 | — |
| Typo3 | Typo3 | 4.6.0 | — |
| Typo3 | Typo3 | 4.6.1 | — |
| Typo3 | Typo3 | 4.6.2 | — |
| Typo3 | Typo3 | 4.6.3 | — |
| Typo3 | Typo3 | 4.6.4 | — |
| Typo3 | Typo3 | 4.6.5 | — |
| Typo3 | Typo3 | 4.6.6 | — |
| Typo3 | Typo3 | 4.6.7 | — |
| Typo3 | Typo3 | 4.6.8 | — |
| Typo3 | Typo3 | 4.6.9 | — |
| Typo3 | Typo3 | 4.6.10 | — |
Showing 50 of 116 affected configurations. See NVD for the full list.
References
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/Exploit, Vendor Advisory
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003/Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-9509?
How severe is CVE-2014-9509?
How do I fix CVE-2014-9509?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-9503The Discussions sub module in the Open Atrium module 7.x-2.x…
- CVE-2014-9504The OG Subgroups module, when used with the Open Atrium modu…
- CVE-2014-9505Cross-site scripting (XSS) vulnerability in the School Admin…
- CVE-2014-9506MantisBT before 1.2.18 does not properly check permissions w…
- CVE-2014-9507MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1…
- CVE-2014-9508The frontend rendering component in TYPO3 4.5.x before 4.5.3…
- CVE-2014-9510Cross-site request forgery (CSRF) vulnerability in the admin…
- CVE-2014-9512rsync 3.1.1 allows remote attackers to write to arbitrary fi…
- CVE-2014-9513Insecure use of temporary files in xbindkeys-config 0.1.3-2 …
- CVE-2014-9514Cross-site scripting (XSS) vulnerability in BMC Footprints S…
- CVE-2014-9515Dozer improperly uses a reflection-based approach to type co…9.8
- CVE-2014-9516Cross-site scripting (XSS) vulnerability in Social Microblog…
Are you affected by CVE-2014-9509?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST