PT-2019-15982 · Typo3 · Typo3

Dhiraj Shrikant Datar · Publicado 2019-12-17 · Atualizado 2022-05-24 · CVE-2019-19850

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 8.7.30 TYPO3 versions 9.x prior to 9.5.12 TYPO3 versions 10.x prior to 10.2.2

Description The issue is related to the mishandling of escaping of user-submitted content, making the class QueryGenerator vulnerable to SQL injection. Exploitation of this issue requires the system extension ext:lowlevel to be installed and a valid backend user with administrator privileges.

Recommendations For versions prior to 8.7.30, update to version 8.7.30 or later. For versions 9.x prior to 9.5.12, update to version 9.5.12 or later. For versions 10.x prior to 10.2.2, update to version 10.2.2 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-19850

GHSA-59PJ-7MJH-4465

Produtos afetados

Typo3

Referências · 6

• https://github.com/TYPO3/typo3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19850 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-19850 · Aviso do Fabricante
• https://review.typo3.org/q/%2522Resolves:+%252389452%2522+topic:security · Aviso do Fabricante
• https://typo3.org/security/advisory/typo3-core-sa-2019-025 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-59pj-7mjh-4465 · Aviso do Fabricante