Every CVESearch/Get API key

CVE-2014-3942

TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

6.0 MediumFix available

CVE-2014-3942 is a medium vulnerability (CVSS 6.0) in Typo3, published May 31, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in typo3/cms 4.5.34.

What does this mean?
Severity
6.0 MediumCVSS 2.0, NVD
Exploit chance
1.63%EPSS, 76th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.5.34typo3/cms +4 more

Description

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

Exploit likelihood

1.63%Up 0.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
typo3/cms
Packagist
4.5.0 up to 4.5.34
4.5.34
typo3/cms
Packagist
4.7.0 up to 4.7.19
4.7.19
typo3/cms
Packagist
6.0.0 up to 6.0.14
6.0.14
typo3/cms
Packagist
6.1.0 up to 6.1.9
6.1.9
typo3-src
Debian:7
From an advisory covering 6 CVEs
before 4.5.19+dfsg1-5+wheezy3, plus listed versions
4.5.19+dfsg1-54.5.19+dfsg1-5+wheezy14.5.19+dfsg1-5+wheezy2
4.5.19+dfsg1-5+wheezy3

What each source reports

NVD Score used6.0

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

Record
CVE-2014-3942
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE ListNo score

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

Record
CVE-2014-3942
Updated
2026-11-02
EUVDEUVD-2014-3878No score

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

Record
EUVD-2014-3878
Updated
2026-11-03
GitHub AdvisoriesGHSA-55g3-fjwm-w2c88.7

TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

Record
GHSA-55g3-fjwm-w2c8
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-55g3-fjwm-w2c88.7

TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.

Record
GHSA-55g3-fjwm-w2c8
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open