CVE-2014-9508 — Link Following in CMS

CWE-59 — Link Following4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 47.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Typo3 CMSTypo3
Timeline
PublishedJan 4
Latest updateMay 17

Description

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶Packagisttypo3/cms4.5.0 — 4.5.39+2
▶NVDtypo3/typo3116 versions+115

🔴Vulnerability Details

3
OSV
Typo3 Open Redirect In Frontend Rendering↗2022-05-17
▶
GHSA
Typo3 Open Redirect In Frontend Rendering↗2022-05-17
▶
CVEList
CVE-2014-9508: The frontend rendering component in TYPO3 4↗2015-01-04
▶
CVE-2014-9508 — Link Following in Typo3 CMS | cvebase