Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

TYPO3: Malicious Links Can Redirect Users to Arbitrary Domains

CVE-2014-9508 · published 11 years ago
Summary

A security issue in TYPO3 versions 4.5.x, 4.6.x, 6.2.x, and 7.x allows attackers to redirect users to other websites by manipulating links on a website. This could lead to phishing or other malicious activities. Update your TYPO3 installation to the latest version to fix this issue.

What to do
  • Update typo3 cms to version 4.5.39.
  • Update typo3 cms to version 6.2.9.
  • Update typo3 cms to version 7.0.2.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms >= 4.5.0, < 4.5.39
>= 4.6.0, < 6.2.9
>= 7.0.0, < 7.0.2
Fix: upgrade to 4.5.39
– typo3 typo3 4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.10
4.5.11
104 more version ranges
cpe:2.3:a:typo3:typo3:4.5.0:*:*:*:*:*:*:*
Original advisory text
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that onl...
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.
References
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published4 Jan 2015
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-v6xv-rmqc-wcc8 · GHSA
CVE-2014-9508 · NVD
Track software like this
Free during beta