Lucene search

[email protected]CVE-2014-8325

HistoryOct 22, 2014 - 2:55 p.m.

CVE-2014-8325

2014-10-2214:55:08

CWE-399

[email protected]

web.nvd.nist.gov

typo3

calendar base

extension

cve-2014-8325

denial of service

vulnerability

php

pcre

nvd

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

6.9 Medium

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.5%

JSON

The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resource consumption) via vectors related to the PHP PCRE library.

Affected configurations

NVD

Node

calender_base_projectcalender_baseRange≤1.5.8typo3

calender_base_projectcalender_baseMatch1.5.0typo3

calender_base_projectcalender_baseMatch1.5.1typo3

calender_base_projectcalender_baseMatch1.5.2typo3

calender_base_projectcalender_baseMatch1.5.3typo3

calender_base_projectcalender_baseMatch1.5.4typo3

calender_base_projectcalender_baseMatch1.5.5typo3

calender_base_projectcalender_baseMatch1.5.6typo3

calender_base_projectcalender_baseMatch1.5.7typo3

calender_base_projectcalender_baseMatch1.6.0typo3

CPENameOperatorVersion
calender_base_project:calender_basecalender base project calender basele1.5.8
calender_base_project:calender_basecalender base project calender baseeq1.5.0
calender_base_project:calender_basecalender base project calender baseeq1.5.1
calender_base_project:calender_basecalender base project calender baseeq1.5.2
calender_base_project:calender_basecalender base project calender baseeq1.5.3
calender_base_project:calender_basecalender base project calender baseeq1.5.4
calender_base_project:calender_basecalender base project calender baseeq1.5.5
calender_base_project:calender_basecalender base project calender baseeq1.5.6
calender_base_project:calender_basecalender base project calender baseeq1.5.7
calender_base_project:calender_basecalender base project calender baseeq1.6.0

CPE	Name	Operator	Version
calender_base_project:calender_base	calender base project calender base	le	1.5.8
calender_base_project:calender_base	calender base project calender base	eq	1.5.0
calender_base_project:calender_base	calender base project calender base	eq	1.5.1
calender_base_project:calender_base	calender base project calender base	eq	1.5.2
calender_base_project:calender_base	calender base project calender base	eq	1.5.3
calender_base_project:calender_base	calender base project calender base	eq	1.5.4
calender_base_project:calender_base	calender base project calender base	eq	1.5.5
calender_base_project:calender_base	calender base project calender base	eq	1.5.6
calender_base_project:calender_base	calender base project calender base	eq	1.5.7
calender_base_project:calender_base	calender base project calender base	eq	1.6.0

References

typo3.org/extensions/repository/view/cal

typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-013/

www.openwall.com/lists/oss-security/2014/10/17/11

www.securityfocus.com/bid/70645

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

6.9 Medium

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.5%

JSON

Related for CVE-2014-8325

nvd1 typo31 cvelist1 prion1