TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

MEDIUM 6.0CVE-2014-3942 · GHSA-55g3-fjwm-w2c8 · Published 03/06/2014 · updated 17/06/2026

In short

CVE-2014-3942 is a MEDIUM (CVSS 6.0) vulnerability affecting typo3/cms, typo3 (typo3).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.3% of all vulnerabilities.
Fix: update to 4.5.34, 4.7.19, 6.0.14, 6.1.9 or later.

Package	Affected versions	Patched versions
typo3/cms Packagist	`≥ 4.5.0, < 4.5.34≥ 4.7.0, < 4.7.19≥ 6.0.0, < 6.0.14≥ 6.1.0, < 6.1.9`	`4.5.344.7.196.0.146.1.9`
typo3 typo3	`= 4.5.0= 4.5.1= 4.5.10= 4.5.11= 4.5.12= 4.5.13= 4.5.14= 4.5.15= 4.5.16= 4.5.17= 4.5.18= 4.5.19= 4.5.2= 4.5.20= 4.5.21= 4.5.22= 4.5.23= 4.5.24= 4.5.25= 4.5.26= 4.5.27= 4.5.28= 4.5.29= 4.5.3= 4.5.30= 4.5.31= 4.5.32= 4.5.33= 4.5.4= 4.5.5= 4.5.6= 4.5.7= 4.5.8= 4.5.9= 4.7.0= 4.7.1= 4.7.10= 4.7.11= 4.7.12= 4.7.13= 4.7.14= 4.7.15= 4.7.16= 4.7.17= 4.7.18= 4.7.2= 4.7.3= 4.7.4= 4.7.5= 4.7.6= 4.7.7= 4.7.8= 4.7.9= 6.0= 6.0.1= 6.0.10= 6.0.11= 6.0.12= 6.0.13= 6.0.2= 6.0.3= 6.0.4= 6.0.5= 6.0.6= 6.0.7= 6.0.8= 6.0.9= 6.1= 6.1.1= 6.1.2= 6.1.3= 6.1.4= 6.1.5= 6.1.6= 6.1.7= 6.1.8`	No fix yet

Description

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-3942 · ADVISORY
TYPO3/typo3 · PACKAGE
typo3.org/security/advisory/typo3-core-sa-2014-001 · WEB
lists.opensuse.org/opensuse-updates/2014-06/msg00037.html · WEB
debian.org/security/2014/dsa-2942 · WEB
openwall.com/lists/oss-security/2014/06/03/2 · WEB
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001 · Vendor Advisory

More vulnerabilities in typo3/cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

typo3/cms

Packagist

≥ 4.5.0, < 4.5.34≥ 4.7.0, < 4.7.19≥ 6.0.0, < 6.0.14≥ 6.1.0, < 6.1.9

4.5.344.7.196.0.146.1.9

typo3

= 4.5.0= 4.5.1= 4.5.10= 4.5.11= 4.5.12= 4.5.13= 4.5.14= 4.5.15= 4.5.16= 4.5.17= 4.5.18= 4.5.19= 4.5.2= 4.5.20= 4.5.21= 4.5.22= 4.5.23= 4.5.24= 4.5.25= 4.5.26= 4.5.27= 4.5.28= 4.5.29= 4.5.3= 4.5.30= 4.5.31= 4.5.32= 4.5.33= 4.5.4= 4.5.5= 4.5.6= 4.5.7= 4.5.8= 4.5.9= 4.7.0= 4.7.1= 4.7.10= 4.7.11= 4.7.12= 4.7.13= 4.7.14= 4.7.15= 4.7.16= 4.7.17= 4.7.18= 4.7.2= 4.7.3= 4.7.4= 4.7.5= 4.7.6= 4.7.7= 4.7.8= 4.7.9= 6.0= 6.0.1= 6.0.10= 6.0.11= 6.0.12= 6.0.13= 6.0.2= 6.0.3= 6.0.4= 6.0.5= 6.0.6= 6.0.7= 6.0.8= 6.0.9= 6.1= 6.1.1= 6.1.2= 6.1.3= 6.1.4= 6.1.5= 6.1.6= 6.1.7= 6.1.8

No fix yet

Description

NVD description

More vulnerabilities in typo3/cms

See all →