PT-2019-6672 · Typo3 · Typo3 Core

Franz G. Jahn · Published 2019-11-25 · Updated 2022-04-22 · CVE-2011-3583

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Typo3 Core versions 4.5.0 through 4.5.5

Description The issue is related to the use of prepared statements in Typo3 Core, which could lead to a SQL Injection vulnerability if parameter values are not properly replaced. This can be exploited when two or more parameters are bound to a query and at least two of these parameters come from user input.

Recommendations For Typo3 Core versions 4.5.0 through 4.5.5, ensure that all parameter values are properly replaced to prevent SQL Injection. As a temporary workaround, consider restricting user input for queries with multiple bound parameters until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-3583

GHSA-GX4P-6W86-F8JX

Affected Products

Typo3 Core

References · 8

• https://typo3.org/security/advisory/typo3-core-sa-2011-002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gx4p-6w86-f8jx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3583 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-3583 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://access.redhat.com/security/cve/cve-2011-3583 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641682 · Note
• https://t.me/cibsecurity/8310 · Telegram Post