Remote Information Disclosure in TYPO3 Dynamic Content Elements Extension
CVE-2014-8328

5.3MEDIUM

Key Information:

Vendor

Dynamic Content Elements Project

Status
Dynamic Content Elements
Vendor
CVE Published:
3 February 2020

What is CVE-2014-8328?

The Dynamic Content Elements (dce) extension for TYPO3 prior to version 0.11.5 has a default configuration that exposes sensitive installation environment information. This vulnerability enables remote attackers to gain access to crucial details by intercepting the update check request. The flaw underscores the importance of configuring extensions securely to mitigate risks associated with unauthorized data access.

References

http://typo3.org/teams/security/security-bulletins/typo3-...
x_refsource_MISC
http://typo3.org/extensions/repository/view/dce
x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/97673
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.