CVE-2014-6289

Published: Oct 3, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors.

Affected (2)

Products: Daniel Lienert: Yet Another Gallery · Michael Knoll: Tools For Extbase Developmen

1 product

Yet Another Gallery

1 product

Tools For Extbase Developmen

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Daniel Lienert Yet Another Gallery	version ≤ 3.0.0
Michael Knoll Tools For Extbase Developmen	version ≤ 1.5.0

Related CWEs

References (6)

http://typo3.org/extensions/repository/view/pt_extbase

Source: cve@mitre.org

http://typo3.org/extensions/repository/view/yag

Source: cve@mitre.org

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-005/

Source: cve@mitre.org

Vendor Advisory

http://typo3.org/extensions/repository/view/pt_extbase

Source: af854a3a-2127-422b-91ae-364da2661108

http://typo3.org/extensions/repository/view/yag

Source: af854a3a-2127-422b-91ae-364da2661108

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-005/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.