PT-2013-1913 · Typo3 · Typo3

Thomas Worm · Publicado 2013-07-01 · Atualizado 2022-05-17 · CVE-2012-6144

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.x through 4.5.20 TYPO3 versions 4.6.x through 4.6.13 TYPO3 versions 4.7.x through 4.7.5

Description The issue is related to a SQL injection vulnerability in the Backend History module. This vulnerability allows remote authenticated backend users to execute arbitrary SQL commands. The vulnerability is due to missing encoding of user input, making the history module susceptible to SQL Injection. A valid backend login is required to exploit this issue.

Recommendations For TYPO3 versions 4.5.x through 4.5.20, update to version 4.5.21 or later. For TYPO3 versions 4.6.x through 4.6.13, update to version 4.6.14 or later. For TYPO3 versions 4.7.x through 4.7.5, update to version 4.7.6 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-6144

DSA-2574-1

GHSA-947M-VGQC-X6V4

Produtos afetados

Typo3

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/79964 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6144 · Nota de Segurança
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/06/19/4 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6144 · Nota
• http://osvdb.org/87115 · Nota
• https://osv.dev/vulnerability/GHSA-947m-vgqc-x6v4 · Aviso do Fabricante