fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders

MOYENNE 4.0CVE-2014-8327 · GHSA-xwq4-2cwr-fv2q · Published 27/10/2014 · updated 17/06/2026

En bref

CVE-2014-8327 est une vulnérabilité MOYENNE (CVSS 4.0) touchant co-stack/fal_sftp, vertexvaar/falsftp, fal sftp (fal sftp project).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.1%, plus élevée que 65.4% des vulnérabilités.
Correctif : mettre à jour vers 0.2.6 ou plus récent.

Package	Affected versions	Patched versions
co-stack/fal_sftp Packagist	`< 0.2.6`	`0.2.6`
vertexvaar/falsftp Packagist	`< 0.2.6`	`0.2.6`
fal sftp fal_sftp_project	`= 0.2.4≤ 0.2.5`	No fix yet

Description

The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

NVD description

The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2014-8327 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/97668 · WEB
typo3.org/security/advisory/typo3-ext-sa-2014-014 · WEB
typo3.org/extensions/repository/view/fal_sftp · WEB
typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-014 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free