CVE-2014-3947

Published: Oct 3, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors.

Affected (12)

Products: Alex Kellner: Powermail

Alex Kellner

1 product

Powermail

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Alex Kellner Powermail	Up to 1.6.10
Alex Kellner Powermail	Version 2.0.0
Alex Kellner Powermail	Version 2.0.10
Alex Kellner Powermail	Version 2.0.1
Alex Kellner Powermail	Version 2.0.2
Alex Kellner Powermail	Version 2.0.3
Alex Kellner Powermail	Version 2.0.4
Alex Kellner Powermail	Version 2.0.5
Alex Kellner Powermail	Version 2.0.6
Alex Kellner Powermail	Version 2.0.7
Alex Kellner Powermail	Version 2.0.8
Alex Kellner Powermail	Version 2.0.9

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

http://typo3.org/extensions/repository/view/powermail

Source: cve@mitre.org

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-007/

Source: cve@mitre.org

http://typo3.org/extensions/repository/view/powermail

Source: af854a3a-2127-422b-91ae-364da2661108

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-007/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.