PT-2012-3059 · Typo3 · Mv Cooking

Georg Ringer · Published 2012-02-14 · Updated 2017-08-29 · CVE-2012-1071

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 extension mv cooking versions prior to 0.4.1

Description The issue allows remote attackers to execute arbitrary SQL commands. It has been exploited in the wild as of February 2012.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-1071

Affected Products

Mv Cooking

References · 7

• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1071 · Security Note
• http://secunia.com/advisories/47437 · Vendor Advisory
• http://securityfocus.com/bid/51825 · Note
• http://osvdb.org/78748 · Note
• http://typo3.org/extensions/repository/view/mv_cooking/0.4.1 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72934 · Note