CVE-2014-3942: TYPO3 Color Picker Wizard Component Arbitrary PHP Code Execution Vulnerability
Summary
CVE-2014-3942: TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code. Affects typo3/cms across 4 version ranges.
>= 4.5.0, < 4.5.34
>= 4.7.0, < 4.7.19
>= 6.0.0, < 6.0.14
>= 6.1.0, < 6.1.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is a popular open-source content management system (CMS) that allows users to create and manage websites. It offers a wide range of features, including a flexible templating system, user management, and various extensions to enhance functionality. The Color Picker Wizard component is a feature within TYPO3 that enables editors to select colors for their website designs. However, this component has been found to have a critical vulnerability that allows remote authenticated editors to execute arbitrary PHP code, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the Color Picker Wizard component in TYPO3 versions 4.5.0 to 4.5.34, 4.7.0 to 4.7.19, 6.0.0 to 6.0.14, and 6.1.0 to 6.1.9. It allows remote authenticated users to exploit a flaw in the handling of serialized PHP objects. By crafting a malicious serialized object, an attacker can execute arbitrary PHP code on the server, potentially leading to unauthorized access, data manipulation, or complete system compromise. This vulnerability is classified under CWE-94 (Code Injection) and has a high severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5.0, < 4.5.344.5.34composer require typo3/cms:4.5.34 -
>= 4.7.0, < 4.7.194.7.19composer require typo3/cms:4.7.19 -
>= 6.0.0, < 6.0.146.0.14composer require typo3/cms:6.0.14 -
>= 6.1.0, < 6.1.96.1.9composer require typo3/cms:6.1.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider restricting access to the Color Picker Wizard component to trusted users only. This can help mitigate the risk of exploitation until the system can be updated to a secure version.
Conclusion
The TYPO3 Color Picker Wizard component has a critical vulnerability (CVE-2014-3942) that allows remote authenticated users to execute arbitrary PHP code. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor for vulnerabilities in your applications.
See every vulnerability recorded for typo3/cms →
FAQ
CVE-2014-3942 is a vulnerability in the TYPO3 Color Picker Wizard component that allows remote authenticated users to execute arbitrary PHP code.
The affected versions include TYPO3 4.5.0 to 4.5.34, 4.7.0 to 4.7.19, 6.0.0 to 6.0.14, and 6.1.0 to 6.1.9.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If exploited, this vulnerability can lead to unauthorized access, data manipulation, or complete system compromise, posing a significant security risk.
You can update TYPO3 using Composer with the command: 'composer update typo3/cms'. Make sure to back up your system before updating.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
