CVE-2014-3947

High

Published: 03/10/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

CVE-2014-3947 in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 has an unrestricted file upload vulnerability. Remote attackers can execute arbitrary code by uploading a file with a crafted extension.

Risk Assessment

This vulnerability poses a serious risk to organizations as it allows remote attackers to execute unauthorized code on the server, potentially leading to system compromise.

Recommendation

It is recommended to update the powermail extension to the latest version to mitigate this vulnerability and implement additional security measures for uploaded files.

Other vulnerabilities in powermail extension for TYPO3

CVE-2014-6288High
The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors.

Original NVD description (English source)

Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension, then accessing it via unspecified vectors.