PT-2013-1913 · Typo3 · Typo3

Thomas Worm · Published 2013-07-01 · Updated 2022-05-17 · CVE-2012-6144

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.x through 4.5.20 TYPO3 versions 4.6.x through 4.6.13 TYPO3 versions 4.7.x through 4.7.5

Description The issue is related to a SQL injection vulnerability in the Backend History module. This vulnerability allows remote authenticated backend users to execute arbitrary SQL commands. The vulnerability is due to missing encoding of user input, making the history module susceptible to SQL Injection. A valid backend login is required to exploit this issue.

Recommendations For TYPO3 versions 4.5.x through 4.5.20, update to version 4.5.21 or later. For TYPO3 versions 4.6.x through 4.6.13, update to version 4.6.14 or later. For TYPO3 versions 4.7.x through 4.7.5, update to version 4.7.6 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-6144

DSA-2574-1

GHSA-947M-VGQC-X6V4

Affected Products

Typo3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-6144 · Security Note
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-947m-vgqc-x6v4 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79964 · Note
• http://openwall.com/lists/oss-security/2013/06/19/4 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6144 · Note
• http://osvdb.org/87115 · Note