GHSA-594h-cx6w-p4jf

Source

https://github.com/advisories/GHSA-594h-cx6w-p4jf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-594h-cx6w-p4jf/GHSA-594h-cx6w-p4jf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-594h-cx6w-p4jf

Aliases

CVE-2014-3941

Published

2022-05-14T04:01:58Z

Modified

2024-11-30T05:37:45.810347Z

Summary

Typo3 Host Header Spoofing Vulnerability

Details

TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

Database specific

{
    "nvd_published_at": "2014-06-03T14:55:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-16T22:27:30Z"
}

References

Affected packages

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.5.0

Fixed

4.5.34

Database specific

{
    "last_known_affected_version_range": "<= 4.5.33"
}

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.7.0

Fixed

4.7.19

Database specific

{
    "last_known_affected_version_range": "<= 4.7.18"
}

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.0.14

Database specific

{
    "last_known_affected_version_range": "<= 6.0.13"
}

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.1.0

Fixed

6.1.9

Database specific

{
    "last_known_affected_version_range": "<= 6.1.8"
}

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.2.3

Affected versions

6.*

6.2.0

6.2.1

6.2.2