{"id":"GHSA-v6xv-rmqc-wcc8","aliases":["CVE-2014-9508"],"title":"Typo3 Open Redirect In Frontend Rendering","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains.\n\nAn attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option `config.prefixLocalAnchors` is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri.\n\nInstallations where `config.absRefPrefix` is additionally set to any value are not affected by this vulnerability.\n\nExample of affected configuration:\n\n```php\nconfig.absRefPrefix =\nconfig.prefixLocalAnchors = all \npage = PAGE \npage.10 = TEXT \npage.10.value = <a href=\"#skiplinks\">Skiplinks</a> \n.htaccess:\n\nRewriteCond %{REQUEST_FILENAME} !-f \nRewriteCond %{REQUEST_FILENAME} !-d \nRewriteCond %{REQUEST_FILENAME} !-l \nRewriteRule .* index.php [L] \n```","severity":"medium","score":null,"published":"2022-05-17T03:45:52.000Z","modified":"2024-11-30T05:35:31.018Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-v6xv-rmqc-wcc8","url":"https://osv.dev/vulnerability/GHSA-v6xv-rmqc-wcc8"}],"ranges":[{"events":[{"introduced":"4.5.0"},{"fixed":"4.5.39"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.5.39"]},{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-v6xv-rmqc-wcc8","url":"https://osv.dev/vulnerability/GHSA-v6xv-rmqc-wcc8"}],"ranges":[{"events":[{"introduced":"4.6.0"},{"fixed":"6.2.9"}],"type":"ECOSYSTEM"}],"versions":["6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.2.8"],"fixed":["6.2.9"]},{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-v6xv-rmqc-wcc8","url":"https://osv.dev/vulnerability/GHSA-v6xv-rmqc-wcc8"}],"ranges":[{"events":[{"introduced":"7.0.0"},{"fixed":"7.0.2"}],"type":"ECOSYSTEM"}],"versions":["7.0.0","7.0.1"],"fixed":["7.0.2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2014-9508","https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2014-9508.yaml","https://typo3.org/security/advisory/typo3-core-sa-2014-003","http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html","http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-003"],"sources":[{"name":"OSV","id":"GHSA-v6xv-rmqc-wcc8","modified":"2024-11-30T05:35:31.018112Z","url":"https://osv.dev/vulnerability/GHSA-v6xv-rmqc-wcc8"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T11:55:31.891Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}