GHSA-v6xv-rmqc-wcc8 CVE-2014-9508

Typo3 Open Redirect In Frontend Rendering

Medium Packagist

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 1.72%; Chance of exploitation in the next 30 days. Higher than 77.53% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Fix: 4.5.39; Upgrade typo3/cms to this version or later

Description

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains.

An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option config.prefixLocalAnchors is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri.

Installations where config.absRefPrefix is additionally set to any value are not affected by this vulnerability.

Example of affected configuration:

config.absRefPrefix =
config.prefixLocalAnchors = all 
page = PAGE 
page.10 = TEXT 
page.10.value = <a href="#skiplinks">Skiplinks</a> 
.htaccess:

RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d 
RewriteCond %{REQUEST_FILENAME} !-l 
RewriteRule .* index.php [L]

Affected versions

Packagist

Package	Vulnerable	Fixed in
typo3/cms	`>= 4.5.0, < 4.5.39`	`4.5.39`
typo3/cms	`>= 4.6.0, < 6.2.9`	`6.2.9`
typo3/cms	`>= 7.0.0, < 7.0.2`	`7.0.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

typo3/cms Packagist → `4.5.39`

composer

composer require typo3/cms:^4.5.39

Weakness

CWE-59: Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

How to prevent it

Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2014-9508

Timeline

May 17, 2022 Published
Nov 30, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling	Medium	Also affects typo3/cms
GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool	Medium	Also affects typo3/cms
GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie	High	Also affects typo3/cms
GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login	Medium	Also affects typo3/cms
GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component	Medium	Also affects typo3/cms
GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering	Medium	Also affects typo3/cms
GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module	High	Also affects typo3/cms
GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration	High	Also affects typo3/cms

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor