CVE-2009-4160: jweiland/kk-downloader Vulnerable to Information Disclosure
Summary
CVE-2009-4160: TYPO3 Simple Download-System with Counter and Categories Vulnerable to Information Disclosure. Affects jweiland/kk-downloader versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jweiland/kk-downloader package is a TYPO3 extension that provides a simple download system with counter and categories functionality. It allows users to manage downloadable files and track their downloads. However, versions 1.2.1 and earlier are susceptible to an information disclosure vulnerability, which can expose sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability in the Simple download-system with counter and categories (kk_downloader) extension arises from unspecified attack vectors that allow remote attackers to access sensitive information. This could lead to unauthorized access to user data or system configurations, potentially compromising the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
1.2.2
This is the first release that contains the fix.
composer require jweiland/kk-downloader:1.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may restrict access to the download system by implementing additional authentication measures or by disabling the extension until it can be updated.
Conclusion
The jweiland/kk-downloader package has a vulnerability that allows for information disclosure, affecting versions 1.2.1 and earlier. It is crucial to update to version 1.2.2 or later to mitigate this risk. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for jweiland/kk-downloader →
FAQ
The vulnerability allows remote attackers to obtain sensitive information through unspecified attack vectors.
Versions 1.2.1 and earlier of the jweiland/kk-downloader package are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package immediately, consider implementing additional access controls or disabling the extension until a patch can be applied.
More information can be found in the official advisory on GitHub or by searching for CVE-2009-4160.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.