CVE-2014-6298

Unrestricted file upload vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
VendorProductVersion
mm_forum_projectmm_forum
𝑥
≤ 1.9.2
mm_forum_projectmm_forum
0.1.0
mm_forum_projectmm_forum
0.1.1
mm_forum_projectmm_forum
0.1.2
mm_forum_projectmm_forum
0.1.3
mm_forum_projectmm_forum
0.1.4
mm_forum_projectmm_forum
0.1.5
mm_forum_projectmm_forum
0.1.6
mm_forum_projectmm_forum
0.1.7
mm_forum_projectmm_forum
0.1.8
mm_forum_projectmm_forum
1.8.1
mm_forum_projectmm_forum
1.8.2
mm_forum_projectmm_forum
1.8.3
mm_forum_projectmm_forum
1.9.0
mm_forum_projectmm_forum
1.9.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://typo3.org/extensions/repository/view/mm_forum
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/
http://typo3.org/extensions/repository/view/mm_forum
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-001/