Lucene search

[email protected]CVE-2014-3759

HistoryMay 16, 2014 - 2:55 p.m.

CVE-2014-3759

2014-05-1614:55:05

CWE-89

[email protected]

web.nvd.nist.gov

cve-2014-3759

sql injection

bibtex publications

typo3

security vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.7 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.1%

JSON

Multiple SQL injection vulnerabilities in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allow remote attackers to execute arbitrary SQL commands via vectors related to the (1) search or (2) list functionality.

Affected configurations

NVD

Node

karlen_waltersi_bibtexMatch0.2.3typo3

CPENameOperatorVersion
karlen_walter:si_bibtexkarlen walter si bibtexeq0.2.3

CPE	Name	Operator	Version
karlen_walter:si_bibtex	karlen walter si bibtex	eq	0.2.3

References

seclists.org/fulldisclosure/2014/Apr/314

www.securityfocus.com/archive/1/531980/100/0/threaded

www.securityfocus.com/bid/67145

www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140430-0_Typo3_si_bibtex_extension_SQL_injection_and_XSS_vulnerabilities_v10.txt

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.7 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.1%

JSON

Related for CVE-2014-3759

nvd1 prion1 cvelist1 typo31