CVE-2014-8874
TYPO3 Extension ke_questionnaire 2.5.2 Information Disclosure
Severity Score
5.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire answer forms, which makes it easier for remote attackers to obtain sensitive information via a direct request.
La extensión ke_questionnaire 2.5.2 y anteriores para TYPO3 utiliza nombres previsibles para los formularios de respuestas del cuestionario, lo que facilita a atacantes remotos obtener información sensible a través de una solicitud directa.
The TYPO3 extension ke_questionnaire stores answered questionnaires in a publicly reachable directory on the webserver with filenames that are easily guessable. Version 2.5.2 is affected.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-11-14 CVE Reserved
- 2014-12-01 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/archive/1/534126/100/0/threaded | Mailing List |
URL | Date | SRC |
---|---|---|
http://seclists.org/fulldisclosure/2014/Dec/1 | 2024-08-06 | |
https://www.redteam-pentesting.de/advisories/rt-sa-2014-009 | 2024-08-06 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Kennziffer Search vendor "Kennziffer" | Ke Questionnaire Search vendor "Kennziffer" for product "Ke Questionnaire" | <= 2.5.2 Search vendor "Kennziffer" for product "Ke Questionnaire" and version " <= 2.5.2" | typo3 |
Affected
|