CVE-2014-6289

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-10-03 · updated 2026-06-17
Weakness: CWE-264

Description

The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors.

Affected products

Daniel Lienert Yet Another Gallery: through 3.0.0
Michael Knoll Tools For Extbase Developmen: through 1.5.0

References

http://typo3.org/extensions/repository/view/pt_extbase
http://typo3.org/extensions/repository/view/yag
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-005/
http://typo3.org/extensions/repository/view/pt_extbase
http://typo3.org/extensions/repository/view/yag
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-005/

Get alerted when CVE-2014-6289 or the next vulnerability affects your stack