CVE-2009-1264

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/53278
http://secunia.com/advisories/34586Vendor Advisory
http://typo3.org/extensions/repository/view/sr_feuser_register/2.5.21/Patch, Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-004/Patch, Vendor Advisory
http://www.securityfocus.com/bid/34374Patch
http://www.vupen.com/english/advisories/2009/0938Patch, Vendor Advisory
http://osvdb.org/53278
http://secunia.com/advisories/34586Vendor Advisory
http://typo3.org/extensions/repository/view/sr_feuser_register/2.5.21/Patch, Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-004/Patch, Vendor Advisory
http://www.securityfocus.com/bid/34374Patch
http://www.vupen.com/english/advisories/2009/0938Patch, Vendor Advisory

Timeline

Published: Apr 7, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-12655.0Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel 2.6.24.4, and other versions before 2.6.30-rc1, might allow remote CVE-2009-126610.0Unspecified vulnerability in Wireshark before 1.0.7 has unknown impact and attack vectors.CVE-2009-12675.0Unspecified vulnerability in the LDAP dissector in Wireshark 0.99.2 through 1.0.6, when running on Windows, allows remote attackers to cause CVE-2009-12684.3The Check Point High-Availability Protocol (CPHAP) dissector in Wireshark 0.9.6 through 1.0.6 allows remote attackers to cause a denial of s CVE-2009-12695.0Unspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektr CVE-2009-12707.8libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted TAR file that cau CVE-2009-12715.0The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentati CVE-2009-12725.0The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of servi CVE-2009-12735.0pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether CVE-2009-12745.0Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to CVE-2009-12756.8Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain CVE-2009-12762.1XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate atta