PT-2019-6672 · Typo3 · Typo3 Core

Franz G. Jahn · Publicado 2019-11-25 · Atualizado 2022-04-22 · CVE-2011-3583

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Typo3 Core versions 4.5.0 through 4.5.5

Description The issue is related to the use of prepared statements in Typo3 Core, which could lead to a SQL Injection vulnerability if parameter values are not properly replaced. This can be exploited when two or more parameters are bound to a query and at least two of these parameters come from user input.

Recommendations For Typo3 Core versions 4.5.0 through 4.5.5, ensure that all parameter values are properly replaced to prevent SQL Injection. As a temporary workaround, consider restricting user input for queries with multiple bound parameters until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2011-3583

GHSA-GX4P-6W86-F8JX

Produtos afetados

Typo3 Core

Referências · 8

• https://github.com/TYPO3/typo3 · Nota
• https://typo3.org/security/advisory/typo3-core-sa-2011-002 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2011-3583 · Nota
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641682 · Nota
• https://t.me/cibsecurity/8310 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-gx4p-6w86-f8jx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-3583 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2011-3583 · Aviso do Fabricante