Actu
Vigil@nce - TYPO3: multiple vulnerabilities
June 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use several vulnerabilities of TYPO3.
Impacted products: Debian, TYPO3 Core
Severity: 2/4
Creation date: 22/05/2014
DESCRIPTION OF THE VULNERABILITY
Several vulnerabilities were announced in TYPO3.
An attacker can change the HTTP Host header, in order to inject
data in scripts using $_SERVER[’HTTP_HOST’]. [severity:2/4;
CVE-2014-3941]
An attacker can unserialize data, in order to execute code.
[severity:2/4; CVE-2014-3942]
An attacker can trigger a Cross Site Scripting in Backend, in
order to execute JavaScript code in the context of the web site.
[severity:2/4; CVE-2014-3943]
An attacker can trigger a Cross Site Scripting in ExtJS, in order
to execute JavaScript code in the context of the web site.
[severity:2/4; CVE-2010-4207, CVE-2012-5881]
An authenticated attacker can indefinitely renew his session.
[severity:2/4; CVE-2014-3944]
Hashed passwords are not always salted. [severity:1/4;
CVE-2014-3945]
An attacker, who is member of another group, can obtain sensitive
information. [severity:2/4; CVE-2014-3946]
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/TYPO3-multiple-vulnerabilities-14789
