yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions

HIGH 7.5CVE-2014-6289 · GHSA-46fq-683f-2jwq · Published 03/10/2014 · updated 17/06/2026

In short

CVE-2014-6289 is a HIGH (CVSS 7.5) vulnerability affecting dl/yag, punktde/pt_extbase, yet another gallery (daniel lienert).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.8% of all vulnerabilities.
Fix: update to 3.0.1, 1.5.1 or later.

Package	Affected versions	Patched versions
dl/yag Packagist	`< 3.0.1`	`3.0.1`
punktde/pt_extbase Packagist	`< 1.5.1`	`1.5.1`
yet another gallery daniel_lienert	`≤ 3.0.0`	No fix yet
tools for extbase developmen michael_knoll	`≤ 1.5.0`	No fix yet

Description

The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-6289 · ADVISORY
YAG-Gallery/yag commit 4ab6ca1 · WEB
punktDe/pt_extbase commit 9969635 · WEB
typo3.org/security/advisory/typo3-ext-sa-2014-005 · WEB
typo3.org/extensions/repository/view/pt_extbase · WEB
typo3.org/extensions/repository/view/yag · WEB
typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-005 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free