Description

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.

Remediation

References

CVE-2014-9508

Related Vulnerabilities

TYPO3 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La Vulnerability (CVE-2022-23504)

WordPress Plugin Constant Contact Forms Cross-Site Scripting (1.8.7)

phpMyAdmin Improper Input Validation Vulnerability (CVE-2011-1941)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-3454)

WordPress Plugin Spider Calendar Cross-Site Scripting and SQL Injection Vulnerabilities (1.0.1)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-59 CVE-2014-9508