CVE-2014-9508: TYPO3

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.

Affected products

• TYPO3 TYPO3: version 4.5.0 only; version 4.5.1 only; version 4.5.2 only; version 4.5.3 only; version 4.5.4 only; version 4.5.5 only; …

Published 2015-01-04. Last modified 2026-06-17.