{"api_version":"1","generated_at":"2026-07-23T13:35:37+00:00","cve":"CVE-2014-3946","urls":{"html":"https://cve.report/CVE-2014-3946","api":"https://cve.report/api/cve/CVE-2014-3946.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3946","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3946"},"summary":{"title":"CVE-2014-3946","description":"The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-06-03 14:55:11","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2942","name":"http://www.debian.org/security/2014/dsa-2942","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-2942-1 typo3-src","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/","name":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Multiple Vulnerabilities in TYPO3 CMS -  - TYPO3 - The Enterprise Open Source CMS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2014/06/03/2","name":"http://www.openwall.com/lists/oss-security/2014/06/03/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: CVE ID request: typo3","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3946","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3946","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3946","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"typo3","cpe5":"typo3","cpe6":"6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3946","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"typo3","cpe5":"typo3","cpe6":"6.2.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3946","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"typo3","cpe5":"typo3","cpe6":"6.2.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3946","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"typo3","cpe5":"typo3","cpe6":"6.2.0","cpe7":"beta3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3946","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"typo3","cpe5":"typo3","cpe6":"6.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3946","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"typo3","cpe5":"typo3","cpe6":"6.2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2014-3946","qid":"994899","title":"PHP (Composer) Security Update for typo3/cms (GHSA-vccp-5v5h-p8m6)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:57:17.950Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"DSA-2942","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2014/dsa-2942"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/"},{"name":"[oss-security] 20140603 Re: CVE ID request: typo3","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2014/06/03/2"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-05-22T00:00:00.000Z","descriptions":[{"lang":"en","value":"The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-06-03T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"DSA-2942","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2014/dsa-2942"},{"tags":["x_refsource_CONFIRM"],"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/"},{"name":"[oss-security] 20140603 Re: CVE ID request: typo3","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2014/06/03/2"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-3946","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"DSA-2942","refsource":"DEBIAN","url":"http://www.debian.org/security/2014/dsa-2942"},{"name":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/","refsource":"CONFIRM","url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/"},{"name":"[oss-security] 20140603 Re: CVE ID request: typo3","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2014/06/03/2"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-3946","datePublished":"2014-06-03T14:00:00.000Z","dateReserved":"2014-06-03T00:00:00.000Z","dateUpdated":"2024-08-06T10:57:17.950Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-06-03 14:55:11","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:typo3:typo3:6.2:*:*:*:*:*:*:*","matchCriteriaId":"C7715060-1441-4CF9-BEDF-91D28FE31ECC"},{"vulnerable":true,"criteria":"cpe:2.3:a:typo3:typo3:6.2.0:beta1:*:*:*:*:*:*","matchCriteriaId":"7183456A-52B4-4386-8979-A2ECEA9959FE"},{"vulnerable":true,"criteria":"cpe:2.3:a:typo3:typo3:6.2.0:beta2:*:*:*:*:*:*","matchCriteriaId":"16EEC79F-3293-451C-864E-9CE020F6C730"},{"vulnerable":true,"criteria":"cpe:2.3:a:typo3:typo3:6.2.0:beta3:*:*:*:*:*:*","matchCriteriaId":"8FD27EAD-04D5-4C55-952E-020954B90CEF"},{"vulnerable":true,"criteria":"cpe:2.3:a:typo3:typo3:6.2.1:*:*:*:*:*:*:*","matchCriteriaId":"99262E73-E4A7-4657-A32E-3C289C052675"},{"vulnerable":true,"criteria":"cpe:2.3:a:typo3:typo3:6.2.2:*:*:*:*:*:*:*","matchCriteriaId":"E230A800-B2DE-4ED4-9C6B-961832C39900"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3946","Ordinal":"1","Title":"CVE-2014-3946","CVE":"CVE-2014-3946","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3946","Ordinal":"1","NoteData":"The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated users to read arbitrary queries via unspecified vectors.","Type":"Description","Title":"CVE-2014-3946"},{"CveYear":"2014","CveId":"3946","Ordinal":"2","NoteData":"2014-06-03","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3946","Ordinal":"3","NoteData":"2014-06-03","Type":"Other","Title":"Modified"}]}}}