CVE-2014-9509

highpriority · track · 31EPSS 0.015 · 74 %ileEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.50% (74th) EPSS
CVSS 7.5 · high
Is it mine?
124 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached, allows remote attackers to have an unspecified impact (possibly resource consumption) via a "Cache Poisoning" attack using a URL with arbitrary arguments, which triggers a reload of the page.

01

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7.5

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USprimaryCWE-20US
03

affected products (124)

Products and version ranges known to be affected.

showing 20 of 124
04

advisories (1)

Vendor and ecosystem advisories describing this.

  • GHSA-5479-gqqr-f9gjTypo3 Vulnerable to Cache Poisoning2022-05-17ghsa · osvUS

    **Problem Description:** A request URL with arbitrary arguments, but still pointing to the home page of a TYPO3 installation can be cached if the configuration option `config.prefixLocalAnchors` is used with the values "all" or "cached". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. **Solution:** Removing the configuration options `config.prefixLocalAnchors` (and optionally also config.baseUrl) in favor of `config.absRefPrefix` **Credits:** Thanks to Gernot Leitgab who discovered and reported the vulnerability.

05

also known as (3)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdenisa_euvdnvdosvNVDCVE.orgMITRE
published 2015-01-04modified 2026-06-17
08

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan