CVE-2014-9509: Typo3/cms Typo3 Vulnerable To Cache Poisoning Vulnerability
HIGHCVE-2014-9509 is a HIGH typo3 vulnerable to cache poisoning vulnerability (CWE-20: Improper Input Validation) affecting Typo3/cms libraries in the Packagist ecosystem. The issue involves typo3 vulnerable to cache poisoning. Remediation is available by upgrading affected packages to version 4.5.39, 6.2.9, 7.0.2, 4.6.19, 4.7.21, 6.0.15, 6.1.13.
CVE-2014-9509 at a Glance
How to Fix CVE-2014-9509
To remediate this vulnerability, upgrade all affected Typo3/cms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade typo3/cms to 4.5.39Upgrade typo3/cms to 6.2.9Upgrade typo3/cms to 7.0.2Upgrade typo3/cms to 4.6.19Upgrade typo3/cms to 4.7.21Upgrade typo3/cms to 6.0.15Upgrade typo3/cms to 6.1.13Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for typo3/cmsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2014-9509, inspect your project dependencies for Typo3/cms:
inspect dependencies for typo3/cmsAnalyze the terminal output to locate any version of Typo3/cms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.5.39), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Typo3/cms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2014-9509 Affected Typo3/cms Versions
7 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
typo3/cms
|
Packagist |
≥ 4.5.0
< 4.5.39
|
4.5.39
|
|
typo3/cms
|
Packagist |
≥ 6.2.0
< 6.2.9
|
6.2.9
|
|
typo3/cms
|
Packagist |
≥ 7.0.0
< 7.0.2
|
7.0.2
|
|
typo3/cms
|
Packagist |
≥ 4.6.0
< 4.6.19
|
4.6.19
|
|
typo3/cms
|
Packagist |
≥ 4.7.0
< 4.7.21
|
4.7.21
|
|
typo3/cms
|
Packagist |
≥ 6.0.0
< 6.0.15
|
6.0.15
|
|
typo3/cms
|
Packagist |
≥ 6.1.0
< 6.1.13
|
6.1.13
|
References
Frequently Asked Questions
What is CVE-2014-9509?
Which Typo3/cms versions are affected?
What version fixes CVE-2014-9509?
Is typo3/cms affected?
What CWE is associated with CVE-2014-9509?
How can I check Packagist dependencies for CVE-2014-9509?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-5479-gqqr-f9gj",
"modified" : "2023-08-16T23:14:19Z",
"published" : "2022-05-17T04:18:00Z",
"aliases" : [ "CVE-2014-9509" ],
"summary" : "Typo3 Vulnerable to Cache Poisoning",
"details" : "**Problem Description:** A request URL with arbitrary arguments, but still pointing to the home page of a TYPO3 installation can be cached if the configuration option `config.prefixLocalAnchors` is used with the values \"all\" or \"cached\". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page.\n\n**Solution:** Removing the configuration options `config.prefixLocalAnchors` (and optionally also config.baseUrl) in favor of `config.absRefPrefix`\n\n**Credits:** Thanks to Gernot Leitgab who discovered and reported the vulnerability.\n\n",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "typo3/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.5.0"
}, {
"fixed" : "4.5.39"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "typo3/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.2.0"
}, {
"fixed" : "6.2.9"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "typo3/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.0.0"
}, {
"fixed" : "7.0.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "typo3/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.6.0"
}, {
"fixed" : "4.6.19"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.6.18"
}
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "typo3/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.7.0"
}, {
"fixed" : "4.7.21"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.7.20"
}
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "typo3/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.0.0"
}, {
"fixed" : "6.0.15"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 6.0.14"
}
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "typo3/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.1.0"
}, {
"fixed" : "6.1.13"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 6.1.12"
}
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2014-9509"
}, {
"type" : "WEB",
"url" : "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-20" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-08-16T23:14:19Z",
"nvd_published_at" : "2015-01-04T21:59:00Z"
}
}