TYPO3 Questionnaire Extension CVE-2014-8874 Information Disclosure Vulnerability

Bugtraq ID:	71390
Class:	Design Error
CVE:	CVE-2014-8874
Remote:	Yes
Local:	No
Published:	Dec 01 2014 12:00AM
Updated:	Dec 03 2014 12:56AM
Credit:	RedTeam Pentesting GmbH
Vulnerable:
Not Vulnerable:

TYPO3 Questionnaire Extension CVE-2014-8874 Information Disclosure Vulnerability

The Questionnaire extension for TYPO3 is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may aid in further attacks.

TYPO3 Questionnaire Extension CVE-2014-8874 Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

The following example data is available:

python wfuzz.py -c -z range,14000-15000 -z range,1-10 --hc 301 http://example.com/typo3temp/tx_kequestionnaire_temp_FUZZ_FUZ2Z

TYPO3 Questionnaire Extension CVE-2014-8874 Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TYPO3 Questionnaire Extension CVE-2014-8874 Information Disclosure Vulnerability

References:

• Questionnaire Homepage (TYPO3)
  
• TYPO3 Homepage (TYPO3)