CVE-2014-6289
High
Description
The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors.
SeverityHigh
CVSS7.5
Exploit probability—
ProductMichael Knoll Tools For Extbase Developmen
PublishedOct 3, 2014
First seenOct 3, 2014
How to fix
Update
- dl/yag3.0.1 or later
- punktde/pt_extbase1.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| michael_knoll tools_for_extbase_developmen | v ≤ 1.5.0 | — |
| daniel_lienert yet_another_gallery | v ≤ 3.0.0 | — |
| dl/yagPackagist | v < 3.0.1 | 3.0.1 |
| punktde/pt_extbasePackagist | v < 1.5.1 | 1.5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.