CVE-2014-6289 yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions
Remote attackers can bypass access restrictions to execute arbitrary controller actions in TYPO3 gallery and Extbase tools extensions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-6289?
CVE-2014-6289 is a high-severity missing authorization vulnerability in n/a, published on 3 Oct 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors.
Weakness: CWE-264
Which versions are affected by CVE-2014-6289?
4 open source packages ship an affected version, including dl/yag and punktde/pt_extbase. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
dl/yag Packagist | All versions | 3.0.1 |
dl/yag Packagist | All versions | 3.0.1 |
punktde/pt_extbase Packagist | All versions | 1.5.1 |
punktde/pt_extbase Packagist | All versions | 1.5.1 |
Products include Daniel Lienert Yet Another Gallery, Michael Knoll Tools for Extbase Developmen.
How do I fix CVE-2014-6289?
Upgrade dl/yag to 3.0.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-6289 being exploited?
There is no known exploitation of CVE-2014-6289 in the wild and no public exploit code.
Sources
Also known as GHSA-46fq-683f-2jwq.